openapi: 3.0.3
info:
  title: BringYour API
  description: |
    Public surface for BringYour — the harness-migration tool + remote MCP server.

    The primary programmable surface is the Model Context Protocol endpoint at
    `/mcp` (streamable-http JSON-RPC 2.0). REST endpoints below are for discovery
    and billing. All MCP `tools/call` invocations require a valid per-buyer
    license key delivered via the `X-License-Key` header.
  version: "1.0"
  contact:
    email: hello@bringyour.ai
  license:
    name: Proprietary — $49 lifetime license
    url: https://bringyour.ai/buy
servers:
  - url: https://bringyour.ai
    description: Production
paths:
  /mcp:
    post:
      summary: Model Context Protocol JSON-RPC endpoint
      description: |
        Streamable-http MCP transport. Call `tools/list` unauthed to enumerate
        the 4 tools. `tools/call` for any tool requires a valid `X-License-Key`
        header issued by the Stripe webhook after a $49 purchase.
      operationId: mcpJsonRpc
      parameters:
        - name: X-License-Key
          in: header
          description: Per-buyer license key. Required only for tools/call.
          required: false
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [jsonrpc, method, id]
              properties:
                jsonrpc:
                  type: string
                  enum: ["2.0"]
                method:
                  type: string
                  example: tools/list
                id:
                  oneOf:
                    - type: string
                    - type: integer
                params:
                  type: object
      responses:
        "200":
          description: JSON-RPC 2.0 response
          content:
            application/json:
              schema:
                type: object
        "401":
          description: Missing or invalid X-License-Key on a paid tool call
  /api/stripe/webhook:
    post:
      summary: Stripe webhook receiver
      description: |
        Verifies the `Stripe-Signature` header (HMAC-SHA256, ±5min replay
        window). On `checkout.session.completed`, mints a signed ed25519
        license envelope and emails it to the buyer via Resend.

        Not intended for public use.
      operationId: stripeWebhook
      responses:
        "200":
          description: Accepted
        "400":
          description: Signature failed verification
        "503":
          description: Secrets not configured yet
  /api/v1:
    get:
      summary: API catalog root
      description: Discovery endpoint listing the structured API surface.
      operationId: apiRoot
      responses:
        "200":
          description: JSON catalog
          content:
            application/json:
              schema:
                type: object
  /health:
    get:
      summary: Liveness probe
      operationId: health
      responses:
        "200":
          description: ok
          content:
            text/plain:
              schema:
                type: string
                example: "ok"
  /llms.txt:
    get:
      summary: llms.txt agent-discovery brief
      operationId: llmsTxt
      responses:
        "200":
          description: Plain-text description of the product for LLM agents.
  /.well-known/ai-plugin.json:
    get:
      summary: OpenAI-style AI Plugin manifest
      operationId: aiPlugin
      responses:
        "200":
          description: ai-plugin.json
          content:
            application/json:
              schema:
                type: object
