openapi: 3.0.3
info:
  title: WorkPulse API
  version: "1.0"
  description: |
    Minimal API for WorkPulse web + mobile. Supports API key authentication.
servers:
  - url: https://workpulse.weststar-dev.com
components:
  securitySchemes:
    ApiKey:
      type: apiKey
      in: header
      name: X-API-Key
    Bearer:
      type: http
      scheme: bearer
    cookieAuth:
      type: apiKey
      in: cookie
      name: PHPSESSID
paths:
  /api/auth_me.php:
    get:
      summary: Current user
      security:
        - ApiKey: []
        - Bearer: []
      responses:
        '200':
          description: OK
  /api/auth_login.php:
    post:
      summary: Login (web session)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                email: { type: string, format: email }
                password: { type: string }
      responses:
        '200': { description: OK }
  /api/api_keys_create.php:
    post:
      summary: Create API key
      security:
        - cookieAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [name]
              properties:
                name: { type: string }
      responses:
        '200': { description: OK }
  /api/api_keys_list.php:
    get:
      summary: List API keys
      security:
        - cookieAuth: []
      responses:
        '200': { description: OK }
  /api/api_keys_revoke.php:
    post:
      summary: Revoke API key
      security:
        - cookieAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [id]
              properties:
                id: { type: integer }
      responses:
        '200': { description: OK }
  /api/tasks_board.php:
    get:
      summary: Kanban board (owned or assigned tasks)
      security:
        - cookieAuth: []
      responses:
        '200':
          description: Returns board columns with tasks and current user id.
  /api/tasks_permissions.php:
    get:
      summary: Task assignee options & permission
      security:
        - cookieAuth: []
      responses:
        '200': { description: OK }
  /api/tasks_create.php:
    post:
      summary: Create a task
      security:
        - cookieAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [title]
              properties:
                title: { type: string }
                description: { type: string }
                priority: { type: string, enum: [low, medium, high] }
                due_date: { type: string, format: date }
                assignee_user_id: { type: integer, nullable: true }
      responses:
        '200': { description: OK }
  /api/tasks_move.php:
    post:
      summary: Drag/drop move task status
      security:
        - cookieAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [id, status]
              properties:
                id: { type: integer }
                status: { type: string, enum: [todo, in_progress, review, done] }
      responses:
        '200': { description: OK }
  /api/tasks_update_status.php:
    post:
      summary: Update task status with remarks
      security:
        - cookieAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [id, status]
              properties:
                id: { type: integer }
                status: { type: string, enum: [todo, in_progress, review, done] }
                remarks: { type: string }
      responses:
        '200': { description: OK }
  /api/tasks_detail.php:
    get:
      summary: Task detail with subtasks and activity
      security:
        - cookieAuth: []
      parameters:
        - in: query
          name: id
          schema: { type: integer }
          required: true
      responses:
        '200': { description: OK }
  /api/tasks_activity.php:
    get:
      summary: Task activity history
      security:
        - cookieAuth: []
      parameters:
        - in: query
          name: id
          schema: { type: integer }
          required: true
      responses:
        '200': { description: OK }
  /api/tasks_subtask_create.php:
    post:
      summary: Create a subtask
      security:
        - cookieAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [task_id, title]
              properties:
                task_id: { type: integer }
                title: { type: string }
                status: { type: string, enum: [todo, in_progress, review, done] }
                remarks: { type: string }
      responses:
        '200': { description: OK }
  /api/tasks_subtask_update.php:
    post:
      summary: Update a subtask
      security:
        - cookieAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [id]
              properties:
                id: { type: integer }
                title: { type: string }
                status: { type: string, enum: [todo, in_progress, review, done] }
                remarks: { type: string }
      responses:
        '200': { description: OK }
  /api/tasks_subtask_delete.php:
    post:
      summary: Delete a subtask
      security:
        - cookieAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [id]
              properties:
                id: { type: integer }
      responses:
        '200': { description: OK }
  /api/tasks_delete.php:
    post:
      summary: Delete a task (owner only)
      security:
        - cookieAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [id]
              properties:
                id: { type: integer }
      responses:
        '200': { description: OK }
  /api/admin_link_person.php:
    post:
      summary: Link admin person record
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/approvals_list.php:
    get:
      summary: List approvals
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/approvals_set.php:
    post:
      summary: Set approval status
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/asset_availability.php:
    get:
      summary: Asset availability calendar
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/asset_book.php:
    post:
      summary: Book an asset
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/asset_booking_cancel.php:
    post:
      summary: Cancel asset booking
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/asset_booking_update.php:
    post:
      summary: Update asset booking
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/asset_bookings_my.php:
    get:
      summary: My asset bookings
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/asset_bookings_pending.php:
    get:
      summary: Pending asset bookings
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/asset_create.php:
    post:
      summary: Create asset
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/asset_update_status.php:
    post:
      summary: Update asset status
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/assets_admin_list.php:
    get:
      summary: Admin asset list
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/assets_list.php:
    get:
      summary: Asset list
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/attendance_daily_update.php:
    post:
      summary: Update daily attendance
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/attendance_day.php:
    get:
      summary: Attendance for a day
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/attendance_event.php:
    post:
      summary: Attendance event
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/attendance_export.php:
    get:
      summary: Export attendance
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/attendance_lib.php:
    get:
      summary: Attendance library helper
      responses: { '200': { description: OK } }
  /api/attendance_list.php:
    get:
      summary: Attendance list
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/attendance_report_export.php:
    get:
      summary: Export attendance report
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/attendance_report_export_month.php:
    get:
      summary: Export attendance report (month)
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/attendance_report_export_month_daily.php:
    get:
      summary: Export attendance report (month daily)
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/attendance_report_list.php:
    get:
      summary: Attendance report list
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/attendance_report_send.php:
    post:
      summary: Send attendance report
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/attendance_sensepass.php:
    post:
      summary: Attendance SensePass webhook
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/attendance_status.php:
    get:
      summary: Attendance status
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/attendance_upsert.php:
    post:
      summary: Upsert attendance
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/attendance_user_month.php:
    get:
      summary: Attendance for user by month
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/attendance_webhook.php:
    post:
      summary: Attendance webhook
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/auth_api.php:
    post:
      summary: API login
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/auth_logout.php:
    post:
      summary: Logout (destroy session)
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/auth_register.php:
    post:
      summary: Registration disabled
      responses:
        '403':
          description: Registration is managed centrally by Auth2 admin.
  /api/auth_password_reset_check.php:
    get:
      summary: Check reset token
      responses: { '200': { description: OK } }
  /api/auth_password_reset_complete.php:
    post:
      summary: Complete password reset
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/auth_password_reset_request.php:
    post:
      summary: Request password reset
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/config_mail.php:
    get:
      summary: Mail config test
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/cron_notify.php:
    get:
      summary: Cron notify
      responses: { '200': { description: OK } }
  /api/dashboard_overview.php:
    get:
      summary: Dashboard overview
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/get_user.php:
    get:
      summary: Get user profile
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/leave_alloc_defaults.php:
    get:
      summary: Leave allocation defaults
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/leave_alloc_list.php:
    get:
      summary: Leave allocation list
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/leave_alloc_save.php:
    post:
      summary: Save leave allocation
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/leave_balance.php:
    get:
      summary: Leave balance
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/leave_create.php:
    post:
      summary: Create leave request
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/leave_list.php:
    get:
      summary: Leave list
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/leave_update_status.php:
    post:
      summary: Update leave status
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/mail_test.php:
    get:
      summary: Mail test
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/mailer.php:
    post:
      summary: Send mail (legacy)
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/mailer_phpmailer.php:
    post:
      summary: Send mail via PHPMailer
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/office_assets_create.php:
    post:
      summary: Create office asset
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/office_assets_export.php:
    get:
      summary: Export office assets
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/office_assets_list.php:
    get:
      summary: Office assets list
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/profile_password.php:
    post:
      summary: Update password
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/profile_update.php:
    post:
      summary: Update profile
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/profile_upload.php:
    post:
      summary: Upload profile picture
      security: [ { cookieAuth: [] } ]
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file: { type: string, format: binary }
      responses: { '200': { description: OK } }
  /api/report_series.php:
    get:
      summary: Report series
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/report_summary.php:
    get:
      summary: Report summary
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/resume_default.php:
    get:
      summary: Default resume
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/resume_get.php:
    get:
      summary: Get resume
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/resume_save.php:
    post:
      summary: Save resume
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/send_mail.php:
    post:
      summary: Send mail
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/settings_get.php:
    get:
      summary: Get settings
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/settings_update.php:
    post:
      summary: Update settings
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/team_create.php:
    post:
      summary: Create team
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/team_invite.php:
    post:
      summary: Invite to team
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/team_link.php:
    post:
      summary: Link team member
      security: [ { cookieAuth: [] } ]
      requestBody: { required: true, content: { application/json: { schema: { type: object } } } }
      responses: { '200': { description: OK } }
  /api/team_list.php:
    get:
      summary: Team list
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/team_members_options.php:
    get:
      summary: Team member options
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
  /api/team_my.php:
    get:
      summary: My team info
      security: [ { cookieAuth: [] } ]
      responses: { '200': { description: OK } }
