{
  "openapi": "3.1.0",
  "info": {
    "title": "Rustle REST Hook API",
    "description": "Register and remove webhook callbacks for App Store & Google Play review and rating events. Authenticate with an API token issued in the console (Integrations) as `Authorization: Bearer rsk_…` or `X-API-Key: rsk_…`.",
    "contact": {
      "name": "Rustle",
      "url": "https://rustle.cloud"
    },
    "license": {
      "name": ""
    },
    "version": "1"
  },
  "servers": [
    {
      "url": "https://app.rustle.cloud",
      "description": "Production"
    }
  ],
  "paths": {
    "/api/v1/apps": {
      "get": {
        "tags": [
          "apps"
        ],
        "summary": "The apps this account already watches — populates a platform UI dropdown (free-text\napp ids are also accepted by subscribe).",
        "operationId": "list_apps",
        "responses": {
          "200": {
            "description": "Apps this account already watches (store, app_id, country)"
          },
          "401": {
            "description": "Missing or invalid API token"
          }
        },
        "security": [
          {
            "bearer": []
          }
        ]
      }
    },
    "/api/v1/hooks": {
      "get": {
        "tags": [
          "hooks"
        ],
        "summary": "List the account's hooks (convenience; not required by the REST Hook flow).",
        "operationId": "list_hooks",
        "responses": {
          "200": {
            "description": "Every hook this account owns",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "$ref": "#/components/schemas/HookView"
                  }
                }
              }
            }
          },
          "401": {
            "description": "Missing or invalid API token"
          }
        },
        "security": [
          {
            "bearer": []
          }
        ]
      },
      "post": {
        "tags": [
          "hooks"
        ],
        "summary": "REST Hook **subscribe**: create an endpoint (callback URL + generated secret + source)\nand the matching watch, ensuring the app enters the poll set. Idempotency is the\nplatform's responsibility (each \"on\" creates one hook); we return a fresh `id` each time.",
        "operationId": "subscribe",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SubscribeBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "description": "Hook created. The HMAC `secret` is returned once.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SubscribeResponse"
                }
              }
            }
          },
          "400": {
            "description": "Invalid body (store, target_url, event_type, star band, or rating rule)",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "401": {
            "description": "Missing or invalid API token"
          }
        },
        "security": [
          {
            "bearer": []
          }
        ]
      }
    },
    "/api/v1/hooks/{id}": {
      "delete": {
        "tags": [
          "hooks"
        ],
        "summary": "REST Hook **unsubscribe**: tear down the endpoint and its watches (GCs the poll set).",
        "operationId": "unsubscribe",
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "description": "The hook id returned by subscribe",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Hook removed"
          },
          "401": {
            "description": "Missing or invalid API token"
          },
          "404": {
            "description": "No hook with that id for this account",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        },
        "security": [
          {
            "bearer": []
          }
        ]
      }
    },
    "/api/v1/sample": {
      "get": {
        "tags": [
          "samples"
        ],
        "summary": "A synthetic representative event for a platform's \"test trigger\" step (Zapier's\n`performList`). Static — it never touches tenant data, so it needs only a valid token.",
        "operationId": "sample",
        "parameters": [
          {
            "name": "event_type",
            "in": "query",
            "description": "`review.created` (default) or `rating.dropped`",
            "required": false,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "A one-element array holding a synthetic event of the requested type"
          },
          "400": {
            "description": "Unknown event_type",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "401": {
            "description": "Missing or invalid API token"
          }
        },
        "security": [
          {
            "bearer": []
          }
        ]
      }
    }
  },
  "components": {
    "schemas": {
      "ErrorResponse": {
        "type": "object",
        "description": "The body returned by every `/api/v1` failure: `{ \"error\": \"<message>\" }`.",
        "required": [
          "error"
        ],
        "properties": {
          "error": {
            "type": "string",
            "description": "Human-readable description of what went wrong.",
            "example": "store must be apple or google"
          }
        }
      },
      "HookView": {
        "type": "object",
        "required": [
          "id",
          "source",
          "target_url"
        ],
        "properties": {
          "external_ref": {
            "type": [
              "string",
              "null"
            ],
            "description": "The platform's correlation crumb, if one was supplied at subscribe time."
          },
          "id": {
            "type": "string",
            "description": "The hook id (pass to `DELETE /api/v1/hooks/{id}` to remove it)."
          },
          "source": {
            "type": "string",
            "description": "Provenance: `zapier` / `make` / `n8n` / `api`."
          },
          "target_url": {
            "type": "string",
            "description": "The callback URL events are delivered to."
          }
        }
      },
      "SubscribeBody": {
        "type": "object",
        "required": [
          "target_url",
          "store",
          "app_id",
          "event_type"
        ],
        "properties": {
          "app_id": {
            "type": "string",
            "description": "Store-native app id (Apple numeric id, Google package name).",
            "example": "284882215"
          },
          "country": {
            "type": [
              "string",
              "null"
            ],
            "description": "Storefront/locale to watch (lowercase ISO-3166 alpha-2); defaults to `us`.",
            "example": "us"
          },
          "delta": {
            "type": [
              "number",
              "null"
            ],
            "format": "double"
          },
          "event_type": {
            "type": "string",
            "description": "`review.created` or `rating.dropped`.",
            "example": "review.created"
          },
          "external_ref": {
            "type": [
              "string",
              "null"
            ],
            "description": "The platform's correlation crumb (e.g. Zapier's `subscription:<uuid>`)."
          },
          "max_stars": {
            "type": [
              "integer",
              "null"
            ],
            "format": "int32",
            "minimum": 0
          },
          "min_stars": {
            "type": [
              "integer",
              "null"
            ],
            "format": "int32",
            "minimum": 0
          },
          "source": {
            "type": [
              "string",
              "null"
            ],
            "description": "Provenance hint from the platform app (`zapier`/`make`/`n8n`); defaults to `api`."
          },
          "store": {
            "type": "string",
            "description": "`apple` or `google`.",
            "example": "apple"
          },
          "target_url": {
            "type": "string",
            "description": "The callback URL the platform wants events delivered to (Zapier's catch URL, etc.).",
            "example": "https://hooks.zapier.com/hooks/catch/123/abc"
          },
          "threshold": {
            "type": [
              "number",
              "null"
            ],
            "format": "double"
          }
        }
      },
      "SubscribeResponse": {
        "type": "object",
        "required": [
          "id",
          "secret",
          "store",
          "app_id",
          "country",
          "event_type"
        ],
        "properties": {
          "app_id": {
            "type": "string"
          },
          "country": {
            "type": "string"
          },
          "event_type": {
            "type": "string"
          },
          "id": {
            "type": "string",
            "description": "The handle the platform stores and passes back to unsubscribe.",
            "example": "zapier-1a2b3c4d5e6f7a8b"
          },
          "secret": {
            "type": "string",
            "description": "The HMAC signing secret, so a platform app may verify `x-radar-signature` if it\nwants. Returned once, over the bearer-authed TLS channel."
          },
          "store": {
            "type": "string"
          }
        }
      }
    },
    "securitySchemes": {
      "bearer": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "rsk_<token>"
      }
    }
  },
  "tags": [
    {
      "name": "hooks",
      "description": "Register and remove webhook callbacks"
    },
    {
      "name": "apps",
      "description": "Apps the account already watches"
    },
    {
      "name": "samples",
      "description": "Synthetic events for a platform's test step"
    }
  ]
}