openapi: 3.0.3
#
#   Zimple Money API definition
#   header information about the company, system, and API
#
info:
  title: Zimple Money API
  description: >
    This is the definition of the API for the Zimple Money system, a simple yet powerful way
    to create loans, automate payments, and manage your loan portfolio.
  contact:
    email: info@zimplemoney.com
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  version: "1.01"
externalDocs:
  description: The API documentation may be viewed online.
  url: http://api.zimplemoney.com
servers:
  - url: http://api.zimplemoney.com
  - url: http://api.zimplemoney.com/sandbox
security:                   # default is to require token, overridden for /login
  - tokenAuth: []
#
#   definition of API endpoints and actions
#
#   high-level object heirarchy
#       login
#       contracts (loans)
#           ledger (history)
#           schedule
#           payments
#           pastpayments
#           posts (memos)
#           documents
#       members (users)
#           account           
#           portfolio (loans)
#           clients
#           accounts (banks and credit cards)
#           security
#           loginhistory
#           addresshistory
#           profilehistory
#           messages (emails and texts)
#       worldinfo
#
paths:

  /login:
    description: >-
      Login as a user to the Zimple Money system (POST) and receive an authorization token.
    post:
      security: []          # no token check, returns token
      summary: sign in to server
      requestBody:
        description: userid / password, optionally on behalf of memId
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                userid:
                  type: string
                password:
                  type: string
                onBehalfOf:
                  type: integer
              required:
                - userid
                - password
      responses:
        "200":        
          description: login successful, return token + welcome info
          content:
            application/json:
              schema:
                type: object
                properties:
                  token:
                    type: string
                  memberId:
                    type: integer
                  message:
                    type: string
                  systemMessage:
                    type: string
        "401":
          description: user not authorized
        "403":
          description: forbidden (user can't sign on behalf of specified memId)
        "404":
          description: user not found
        "500":
          $ref: "#/components/responses/errorResponse"

#--------------------------------------------------------------------------------------------
#       contracts (loans)
#           ledger (history)
#           schedule
#           payments
#           pastpayments
#           posts (memos)
#           documents
#
  /contracts:
    description: >-
      Contracts are loans in the Zimple Money system.  They have an owner, one or mode lenders,
      one or more borrowers, and could have guests (observers).
      
      This endpoint allows an array of all contracts' summary information to be returned (GET), 
      and enables creation of new contracts (POST).
    get:
      summary: retrieve all contracts (to which user has access)
      parameters:
      - name: title         # may include wildcards
        in: query
        schema:
          type: string
      - name: owner         # may include wildcards
        in: query
        schema:
          type: string
      - name: status
        in: query
        schema:
          type: string
      - name: type
        in: query
        schema:
          type: string
      - name: startDate     # format mm/dd/yy
        in: query
        schema:
          type: string
      - name: endDate       # format mm/dd/yy
        in: query
        schema:
          type: string
      responses:
        "200":        
          description: array with summary data for contracts including contractIds
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/contractSummary"
        "401":
          description: user not authorized
        "500":
          $ref: "#/components/responses/errorResponse"
    post:
      summary: create a new contract
      requestBody:
        description: information to create a new contract
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/contractInfo"
      responses:
        "201":              # contract created, return summary including contractId
          description: contract created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/contractSummary"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: user not authorized to create contract
        "500":
          $ref: "#/components/responses/errorResponse"

  /contracts/{contractId}:
    description: >-
      Specific contracts are identified by a {contractId}.
      
      This endpoint enables retrieval of all information for a contract (GET), enables that
      information to be updated (PUT), and enables a contract to be cancelled (DELETE).
    parameters:
    - name: contractId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve info for specific contract
      responses:
        "200":              # retrieval successful, info returned
          description: return contract info
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/contractInfo"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract not found
        "500":
          $ref: "#/components/responses/errorResponse"
    put:
      summary: update info for a specific contract
      requestBody:
        description: contract into to be updated (including notifications)
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/contractInfo"
      responses:
        "200":              # update successful
          $ref: "#/components/responses/successResponse"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract not found
        "500":
          $ref: "#/components/responses/errorResponse"
    delete:
      summary: delete a contract
      responses:
        "200":              # delete successful
          $ref: "#/components/responses/successResponse"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract not found
        "500":
          $ref: "#/components/responses/errorResponse"

  /contracts/{contractId}/ledger:
    description: >-
      Contracts have a ledger (loan history), a record of all transactions and adjustments 
      performed for the loan.
      
      This endpoint enables retrieval of an array of transactions (GET), and creation
      of new transactions via manual entries into the ledger (POST).
    parameters:
    - name: contractId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve ledger for a contract
      responses:
        "200":
          description: array of ledger entries (ledger tab from review page), including entryIds
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/entrySummary"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract not found
        "500":
          $ref: "#/components/responses/errorResponse"
    post:
      summary: add an entry to the ledger
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/entryInfo"
      responses:
        "201":
          description: entry added to ledger, return summary including entryId
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/entrySummary"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to ledger unauthorized
        "500":
          $ref: "#/components/responses/errorResponse"
              
  /contracts/{contractId}/ledger/{entryId}:
    description: >-
      Specific transactions in a contract ledger are identified by an {entryId}.
      
      This endpoint enables retrieval of a specific transaction (GET), updating a
      transaction (PUT), and deleting a transaction (DELETE).
    parameters:
    - name: contractId
      in: path
      required: true
      schema:
        type: integer
    - name: entryId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve specific ledger entry
      responses:
        "200":
          description: data for specified ledger entry
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/entryInfo"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to ledger unauthorized
        "404":
          description: ledger entry not found
        "500":
          $ref: "#/components/responses/errorResponse"
    put:
      summary: update a ledger entry
      requestBody:
        description: new info for ledger entry
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/entryInfo"
      responses:
        "200":
          description: summary info for updated entry
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/entrySummary"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to ledger unauthorized
        "404":
          description: ledger entry not found
        "500":
          $ref: "#/components/responses/errorResponse"
    delete:
      summary: delete ledger entry 
      responses:
        "200":              # delete successful
          $ref: "#/components/responses/successResponse"
        "401":
          description: access to ledger unauthorized
        "404":
          description: ledger entry not found
        "500":
          $ref: "#/components/responses/errorResponse"

  /contracts/{contractId}/schedule:
    description: >-
      Contracts have a payment schedule, which shows all the payments to be made for a loan.
      
      This endpoint enables retrieval of a contract's payment schedule (GET).
    parameters:
    - name: contractId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve payment schedule for contract
      responses:
        "200":
          description: array of payments
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/paymentInfo"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract not found
        "500":
          $ref: "#/components/responses/errorResponse"

  /contracts/{contractId}/payments:
    description: >-
      This endpoint enables retrieval of all payments made for a contract (GET), and 
      making a new payment (POST).
    parameters:
    - name: contractId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve payments for contract
      responses:
        "200":
          description: array of payments
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/paymentInfo"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract not found
        "500":
          $ref: "#/components/responses/errorResponse"
    post:
      summary: make a payment
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: "#/components/schemas/paymentInfo"
      responses:
        "201":
          description: payment made, return info
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/paymentInfo"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract not found
        "500":
          $ref: "#/components/responses/errorResponse"
          
  /contracts/{contractId}/pastpayments:
    description: >-
      This endpoint enables retrieval of all payments (and fees) which are/were due for 
      a contract (GET), and enables updating whether each is now due (PUT).
    parameters:
    - name: contractId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve past payment schedule for contract
      responses:
        "200":
          description: array of payments
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/paymentInfo"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract not found
        "500":
          $ref: "#/components/responses/errorResponse"
    put:
      summary: update past payment status
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: "#/components/schemas/paymentInfo"
      responses:
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract not found
        "500":
          $ref: "#/components/responses/errorResponse"

  /contracts/{contractId}/posts:
    description: >-
      Contracts can have one or more "posts", which are memos associated with the contract.
      
      This endpoint enables retrieval of all posts for a contract (GET), and adding new
      posts (POST).
    parameters:
    - name: contractId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve all posts for a contract, including postIds
      responses:
        "200":
          description: array of posts
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/postInfo"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract not found
        "500":
          $ref: "#/components/responses/errorResponse"
    post:
      summary: add a new post for a contract
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/postInfo"
      responses:
        "201":
          description: post added to contract, return info including postId
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/postInfo"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract not found
        "500":
          $ref: "#/components/responses/errorResponse"

  /contracts/{contractId}/posts/{postId}:
    description: >-
      Contract posts are identified by a {postId}.
      
      This endpoint enables retrieval of an array of all posts for a contract (GET), updating
      a post (PUT), adding a new post for a contract (POST), and deleting a post (DELETE).
    parameters:
    - name: contractId
      in: path
      required: true
      schema:
        type: integer
    - name: postId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve a posts for a contract
      responses:
        "200":
          description: post information
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/postInfo"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract / post not found
        "500":
          $ref: "#/components/responses/errorResponse"
    put:
      summary: update a post for a contract
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/postInfo"
      responses:
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract / post not found
        "500":
          $ref: "#/components/responses/errorResponse"
    post:
      summary: add a new post for a contract
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/postInfo"
      responses:
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to contract unauthorized
        "500":
          $ref: "#/components/responses/errorResponse"
    delete:
      summary: delete post from a contract
      responses:
        "200":              # delete successful
          $ref: "#/components/responses/successResponse"
        "401":
          description: access to contract unauthorized
        "404":
          description: contracy / post not found
        "500":
          $ref: "#/components/responses/errorResponse"
  
  /contracts/{contractId}/documents:
    description: >-
      Contracts can have one or more documents associated with them.
      
      This endpoint enables retrieval of a summary of all documents for a contract (GET), 
      and adding new documents (POST).
    parameters:
    - name: contractId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve all documents for a contract, including documentIds
      responses:
        "200":
          description: array of documents
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/docSummary"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract not found
        "500":
          $ref: "#/components/responses/errorResponse"
    post:
      summary: add a new document for a contract
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/docInfo"
      responses:
        "201":
          description: document added to contract, return summary including documentId
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/docSummary"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract not found
        "500":
          $ref: "#/components/responses/errorResponse"

  /contracts/{contractId}/documents/{documentId}:
    description: >-
      Contract documents are identified by a {documentId}.
      
      This endpoint enables retrieval of a contract document (GET), updating the information
      associated with a document (PUT), and deleteing a document (DELETE).
    parameters:
    - name: contractId
      in: path
      required: true
      schema:
        type: integer
    - name: documentId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve a document for a contract
      responses:
        "200":
          description: document information including doc itself
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/docInfo"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract / document not found
        "500":
          $ref: "#/components/responses/errorResponse"
    put:
      summary: update a document (summary) for a contract
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/docSummary"
      responses:
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to contract unauthorized
        "404":
          description: contract / document not found
        "500":
          $ref: "#/components/responses/errorResponse"
    delete:
      summary: delete document from a contract
      responses:
        "200":              # delete successful
          $ref: "#/components/responses/successResponse"
        "401":
          description: access to contract unauthorized
        "404":
          description: contracy / post not found
        "500":
          $ref: "#/components/responses/errorResponse"

#--------------------------------------------------------------------------------------------
#       members (users)
#           account           
#           portfolio (loans)
#           clients
#           accounts (banks and credit cards)
#           security
#           loginhistory
#           addresshistory
#           profilehistory
#           messages (emails and texts)
#
  /members:
    description: >-
      Members are users in the Zimple Money system.  They can initiate contracts (become the 
      owner), and/or participate in contracts as a lender or borrower, or as a guest (observer).

      This endpoint allows an array of all members' summary information to be returned (GET), 
      and enables creation (registration) of new members (POST).
    get:
      summary: retrieve all members (to which user has access)
      parameters:
      - name: name          # may include wildcards
        in: query
        schema:
          type: string
      - name: status
        in: query
        schema:
          type: string
      - name: startDate     # format mm/dd/yy
        in: query
        schema:
          type: string
      - name: endDate       # format mm/dd/yy
        in: query
        schema:
          type: string
      responses:
        "200":
          description: array with summary data for members including memberIds
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/memberSummary"
        "401":
          description: user not authorized
        "500":
          $ref: "#/components/responses/errorResponse"
    post:
      security: []          # no token check, anyone can create a member
      summary: create (register) a new member
      requestBody:
        description: information to create a new member
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/memberRegInfo"
      responses:
        "201":              # member created, return summary including memId
          description: contract created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/memberSummary"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "500":
          $ref: "#/components/responses/errorResponse"

  /members/{memberId}:
    description: >-
      Specific members are identified by a {memberId}.

      This endpoint enables retrieval of all information for a member (GET), enables that 
      informationo be updated (PUT), and enables a member to be marked inactive (DELETE).
    parameters:
    - name: memberId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve info for a specific member
      responses:
        "200":              # retrieval successful, info returned
          description: return contract info
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/memberInfo"
        "401":
          description: access to member unauthorized
        "404":
          description: member not found
        "500":
          $ref: "#/components/responses/errorResponse"
    put:
      summary: update info for a member
      requestBody:
        description: member into to be updated (profile)
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/memberInfo"
      responses:
        "200":              # update successful
          $ref: "#/components/responses/successResponse"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to member unauthorized
        "404":
          description: member not found
        "500":
          $ref: "#/components/responses/errorResponse"
    delete:
      summary: delete (cancel) a member
      responses:
        "200":              # delete (cancel) successful
          $ref: "#/components/responses/successResponse"
        "401":
          description: access to member unauthorized
        "404":
          description: member not found
        "500":
          $ref: "#/components/responses/errorResponse"

  /members/{memberId}/account:
    description: >-
      This endpoint allows a member's account status with Zimple Money to be retrieved (GET),
      and updated (PUT).
    parameters:
    - name: memberId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve account info for member
      responses:
        "200":              # retrieval successful, info returned
          description: return member account info
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/memberAccountInfo"
        "401":
          description: access to member unauthorized
        "404":
          description: member not found
        "500":
          $ref: "#/components/responses/errorResponse"
    put:
      summary: update account info for a member
      requestBody:
        description: member account info to be updated
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/memberAccountInfo"
      responses:
        "200":              # update successful
          $ref: "#/components/responses/successResponse"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to member unauthorized
        "404":
          description: member not found
        "500":
          $ref: "#/components/responses/errorResponse"

  /members/{memberId}/portfolio:
    description: >-
      Members have a portfolio of contracts in which they are a participant, either as a
      lender, borrower, or guest (observer).
      
      This endpoint allows a member's portfolio (summary of all contracts) to be retrieved
      (GET), along with summary information across all contracts.
    parameters:
    - name: memberId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve contract portfolio for a member
      parameters:
      - name: title         # may include wildcards
        in: query
        schema:
          type: string
      - name: status
        in: query
        schema:
          type: string
      - name: type
        in: query
        schema:
          type: string
      - name: groupBy
        in: query
        schema:
          type: string
      - name: sortBy
        in: query
        schema:
          type: string
      responses:
        "200":
          description: member details (portfolio) including array of contracts with contractIds
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/contractSummary"
        "401":
          description: access to member unauthorized
        "404":
          description: member not found
        "500":
          $ref: "#/components/responses/errorResponse"
  
  /members/{memberId}/transactions:
    description: >-
      This endpoint allows all of a member's transactions to be accessed, payments to contracts,
      transaction fees (ACH and CC), money in and out, across their entire portfolio.
    parameters:
    - name: memberId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve transactions for a member
      parameters:
      - name: startDate     # format mm/dd/yy
        in: query
        schema:
          type: string
      - name: endDate       # format mm/dd/yy
        in: query
        schema:
          type: string
      responses:
        "200":
          description: array of transactions for member / all contracts, within date range
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/transaction"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to member unauthorized
        "404":
          description: member not found
        "500":
          $ref: "#/components/responses/errorResponse"
            
  /members/{memberId}/clients:
    description: >-
      Members may have one or more other members as "clients", on whose behalf they are able to
      access information.
      
      This endpoint enables a summary of all a member's clients to be retrieved (GET).
    parameters:
    - name: memberId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve clients for a member
      responses:
        "200":
          description: array with summary info for all clients
          content:
            application/json:
              schema:
                type: array
                items:
                  allOf:
                  - $ref: "#/components/schemas/memberSummary"
                  - type: object
                    properties:
                      access:
                        type: string
        "401":
          description: user not authorized
        "500":
          $ref: "#/components/responses/errorResponse"

  /members/{memberId}/linkedaccounts:
    description: >-
      Members have one or more linked bank and/or credit card accounts, used to receive 
      and make payments.
      
      This endpoint allows a summary of all accounts for a member to be retrieved (GET),
      and for new accounts to be linked (POST).
    parameters:
    - name: memberId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve linked accounts for a member
      responses:
        "200":
          description: array of linked accounts (bank and CC) for a member, with accountIds
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/linkedAccountInfo"
    post:
      summary: add a new linked account for a member
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: "#/components/schemas/linkedAccountInfo"
      responses:
        "201":
          description: linked account added, return summary including accountId
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/linkedAccountSummary"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: user not authorized
        "500":
          $ref: "#/components/responses/errorResponse"

  /members/{memberId}/accounts/{accountId}:
    description: >-
      Bank or credit card accounts linked to a member are identified by an {accountId}.
      
      This endpoint enables retrieval of information for a linked account (GET), updating
      information for an account (PUT), and removing a linked account from a member (DELETE).
    parameters:
    - name: memberId
      in: path
      required: true
      schema:
        type: integer
    - name: accountId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: get information for a linked account
      responses:
        "200":
          description: info for the account (bank or CC)
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/linkedAccountInfo"
        "401":
          description: user not authorized
        "404":
          description: member / linked account not found
        "500":
          $ref: "#/components/responses/errorResponse"
    put:
      summary: update info for a linked account
      requestBody:
        description: info for the account (bank or CC)
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/linkedAccountInfo"
      responses:
        "200":              # update successful
          $ref: "#/components/responses/successResponse"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: access to member unauthorized
        "404":
          description: member / linked account not found
        "500":
          $ref: "#/components/responses/errorResponse"
    post:
      summary: assign a linked account to a contract
      requestBody:
        content:
          application/json:
            schema:
              type: integer
              title: contractId
      responses:
        "200":              # assignment successful
          $ref: "#/components/responses/successResponse"
        "400":              # parameter error, etc
          $ref: "#/components/responses/errorResponse"
        "401":
          description: user not authorized
        "404":
          description: member / linked account not found
        "500":
          $ref: "#/components/responses/errorResponse"
    delete:
      summary: delete a linked account
      responses:
        "200":              # delete successful
          $ref: "#/components/responses/successResponse"
        "401":
          description: access to member unauthorized
        "404":
          description: member / linked account not found
        "500":
          $ref: "#/components/responses/errorResponse"

  /members/{memberId}/security:
    description: >-
      Members have security information in the Zimple Money system.  This endpoint enables
      retrieval of a member's security information (GET), and updating that information (PUT).
    parameters:
    - name: memberId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve security info for a member
      responses:
        "200":
          description: security info for member
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/memberSecurityInfo"
        "401":
          description: access to member unauthorized
        "404":
          description: member / linked account not found
        "500":
          $ref: "#/components/responses/errorResponse"
    put:
      summary: update security info for a member
      requestBody:
        description: security info for member
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/memberSecurityInfo"
      responses:
        "200":              # security info updated
          $ref: "#/components/responses/successResponse"
        "401":
          description: access to member unauthorized
        "404":
          description: member not found
        "500":
          $ref: "#/components/responses/errorResponse"
          
  /members/{memberId}/loginhistory:
    description: >-
      This endpoint enables a member's login history to be retrieved.
    parameters:
    - name: memberId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve login history for a member
      responses:
        "200":
          description: login history (array)
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    loginDate:
                      type: string
                    loginEmail:
                      type: string
                    loginIPAddress:
                      type: string
        "401":
          description: access to member unauthorized
        "404":
          description: member not found
        "500":
          $ref: "#/components/responses/errorResponse"

  /members/{memberId}/addresshistory:
    description: >-
      This endpoint enables a member's credit card addresses' change history to be 
      retrieved (GET).
    parameters:
    - name: memberId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve credit card address history for a member
      responses:
        "200":
          description: credit card address history (array) including acct_ids
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    name:
                      type: string
                    creditCardAddress:
                      type: string
                    creditCardType:
                      type: string
                    creditCardNumber:
                      type: string
                    expirationDate:
                      type: string
        "401":
          description: access to member unauthorized
        "404":
          description: member not found
        "500":
          $ref: "#/components/responses/errorResponse"

  /members/{memberId}/profilehistory:
    description: >-
      This endpoint enables a member's address (and phone number) change history to be 
      retrieved (GET).
    parameters:
    - name: memberId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve email and phone number change history for a member
      responses:
        "200":
          description: email and phone number change history (array)
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    date:
                      type: string
                    changeDescription:
                      type: string
                    loginIPAddress:
                      type: string
        "401":
          description: access to member unauthorized
        "404":
          description: member not found
        "500":
          $ref: "#/components/responses/errorResponse"
          
  /members/{memberId}/messages:
    description:
      Members receive messages from the Zimple Money system, typically via email and/or SMS,
      and they can be displayed in the online system.
      
      This endpoint enables retrieval of all current messages for a member (GET), and updating
      their status to shown they have been read and should be deleted (PUT).
    parameters:
    - name: memberId
      in: path
      required: true
      schema:
        type: integer
    get:
      summary: retrieve messages for a member
      responses:
        "200":
          description: array of messages and statuses
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/messageInfo"
        "401":
          description: access to member unauthorized
        "404":
          description: member / linked account not found
        "500":
          $ref: "#/components/responses/errorResponse"
    put:
      summary: update messages
      requestBody:
          description: array of messages and statuses
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/messageInfo"
      responses:
        "200":
          description: array of messages and statuses
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/messageInfo"
        "401":
          description: access to member unauthorized
        "404":
          description: member not found
        "500":
          $ref: "#/components/responses/errorResponse"
  
#--------------------------------------------------------------------------------------------

  /worldinfo:
    description:
      This endpoint is only accessible for administrators, and enables summary information to
      be retrieved for a given Zimple Money world, including numbers of members, subscriptions,
      contracts, etc.  These data can also be retrieved via other endpoints such as /contracts
      and /members, but it provides a useful way to retrieve this informmation.
    get:
      summary: retrieve statistics for world (admin and world users only)
      responses:
        "200":
          description: data as per admin dashboard
          content:
            application/json:
              schema:
                type: object
                properties:
                  registeredMembers:
                    type: object
                    properties:
                      bork:
                        type: string
        "401":
          description: access to world info unauthorized
        "500":
          $ref: "#/components/responses/errorResponse"

#--------------------------------------------------------------------------------------------
#
#   schemas and other data objects used above
#
components:

  schemas:
    contractSummary:
      type: object
      properties:
        contractId:
          type: integer
        title:
          type: string
        status:
          type: string
    contractInfo:
      allOf:
      - $ref: "#/components/schemas/contractSummary"
      - type: object
        properties:
          type:
            type: string
          balance:
            type: integer
            
    entrySummary:
      type: object
      properties:
        entryId:
          type: integer
        contractId:
          type: integer
        date:
          type: string
    entryInfo:
      allOf:
      - $ref: "#/components/schemas/entrySummary"
      - type: object
        properties:
          principal:
            type: integer
          interest:
            type: integer
          fees:
            type: integer
          description:
            type: string

    paymentInfo:
      type: object
      properties:
        paymentId:
          type: integer
        contractId:
          type: integer
        date:
          type: string
        payment:
          type: integer
        status:
          type: string
        description:
          type: string
          
    postInfo:
      type: object
      properties:
        postId:
          type: integer
        contractId:
          type: integer
        content:
          type: string
        onlyMe:
          type: boolean
          
    docSummary:
      type: object
      properties:
        documentId:
          type: integer
        contractId:
          type: integer
        description:
          type: string
    docInfo:
      allOf:
      - $ref: "#/components/schemas/docSummary"
      - type: object
        properties:
          filename:
            type: string
          content:          # base64 encoded binary content
            type: string
            
    memberRegInfo:
      type: object
      properties:
        email:
          type: string
        password:
          type: string
        phone:
          type: string
    memberSummary:
      allOf:
      - $ref: "#/components/schemas/memberRegInfo"
      - type: object
        properties:
          memberId:
            type: integer
          name:
            type: string
          status:
            type: string
          createDate:
            type: string
    memberInfo:
      allOf:
      - $ref: "#/components/schemas/memberSummary"
      - type: object
        properties:
          SSN:
            type: string
          birthDate:
            type: string
          address:
            type: string
          cityStZip:
            type: string
    memberAccountInfo:
      allOf:
      - $ref: "#/components/schemas/memberSummary"
      - type: object
        properties:
          plan:
            type: string
          pricingTemplate:
            type: string
          currentFees:
            type: integer

    transaction:
      type: object
      properties:
        date:
          type: string
        amount:
          type: string
        type:
          type: string
        contractId:
          type: integer
        description:
          type: string

    linkedAccountSummary:
      type: object
      properties:
        accountId:
          type: integer
        memberId:
          type: integer
        linkedAccountType:
          type: string
        validated:
          type: boolean
    bankAccountInfo:
      type: object
      properties:
        description:
          type: string
        accountType:
          type: string
        accountName:
          type: string
        accountNumber:
          type: string
        bankRoutingNumber:
          type: string
        addenda:
          type: string
    CCAccountInfo:
      type: object
      properties:
        description:
          type: string
        cardHolder:
          type: string
        cardNumber:
          type: string
        expirationDate:
          type: string
        CVC:
          type: string
        zipCode:
          type: string
    linkedAccountInfo:
      allOf:
      - $ref: "#/components/schemas/linkedAccountSummary"
      - oneOf:              # linkedAccountType indicates which
        - $ref: "#/components/schemas/bankAccountInfo"
        - $ref: "#/components/schemas/CCAccountInfo"
        
    memberSecurityInfo:
      type: object
      properties:
        2FA:
          type: boolean
        password:
          type: string
        Q1:
          type: string
        A1:
          type: string
        Q2:
          type: string
        A2:
          type: string
        Q3:
          type: string
        A3:
          type: string
          
    messageInfo:
      type: object
      properties:
        messageId:
          type: integer
        date:
          type: string
        message:
          type: string
        read:
          type: boolean
        delete:
          type: boolean

  securitySchemes:
    tokenAuth:
      description: access token returned from /login
      type: http
      scheme: bearer

  responses:
    successResponse:
      description: response when an operation succeeds
      content:
        application/json:
          schema:
            type: string
            title: message
    errorResponse:
      description: response when an error occurs
      content:
        application/json:
          schema:
            type: object
            properties:
              code:
                type: integer
              message:
                type: string