{
  "openapi": "3.1.0",
  "info": {
    "title": "iplocus API",
    "version": "1.0.0",
    "description": "Customer IP geolocation and account API. Public demo and operator/admin endpoints are intentionally excluded. Account registration is provisioned by the iplocus team."
  },
  "servers": [
    {
      "url": "https://iplocus-backend.onrender.com",
      "description": "Production API"
    }
  ],
  "tags": [
    { "name": "Lookups", "description": "IP address geolocation" },
    { "name": "Authentication", "description": "Customer account login" },
    { "name": "API keys", "description": "Manage lookup API keys" },
    { "name": "Account", "description": "Plan and quota information" }
  ],
  "paths": {
    "/api/lookup/{ip}": {
      "get": {
        "tags": ["Lookups"],
        "summary": "Look up an IP address",
        "description": "Resolve one IPv4 or IPv6 address. Uses one monthly lookup from the account quota.",
        "operationId": "lookupIp",
        "security": [{ "ApiKeyAuth": [] }],
        "parameters": [
          {
            "name": "ip",
            "in": "path",
            "required": true,
            "description": "A valid IPv4 or IPv6 address.",
            "schema": { "type": "string", "examples": ["8.8.8.8", "2001:4860:4860::8888"] }
          }
        ],
        "responses": {
          "200": {
            "description": "Geolocation and network information.",
            "headers": {
              "X-Quota-Limit": { "$ref": "#/components/headers/QuotaLimit" },
              "X-Quota-Remaining": { "$ref": "#/components/headers/QuotaRemaining" }
            },
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GeoIpResult" } } }
          },
          "400": { "$ref": "#/components/responses/BadRequest" },
          "401": { "$ref": "#/components/responses/Unauthorized" },
          "429": { "$ref": "#/components/responses/QuotaExceeded" },
          "500": { "$ref": "#/components/responses/ServerError" }
        }
      }
    },
    "/api/lookup/me": {
      "get": {
        "tags": ["Lookups"],
        "summary": "Look up the API caller's public IP",
        "description": "Resolves the public IP of the machine making this API request. If called from a server, it returns that server's public IP, not the browser user's IP. Uses one monthly lookup.",
        "operationId": "lookupCallerIp",
        "security": [{ "ApiKeyAuth": [] }],
        "responses": {
          "200": {
            "description": "Geolocation and network information.",
            "headers": {
              "X-Quota-Limit": { "$ref": "#/components/headers/QuotaLimit" },
              "X-Quota-Remaining": { "$ref": "#/components/headers/QuotaRemaining" }
            },
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GeoIpResult" } } }
          },
          "400": { "$ref": "#/components/responses/BadRequest" },
          "401": { "$ref": "#/components/responses/Unauthorized" },
          "429": { "$ref": "#/components/responses/QuotaExceeded" },
          "500": { "$ref": "#/components/responses/ServerError" }
        }
      }
    },
    "/api/lookup/batch": {
      "post": {
        "tags": ["Lookups"],
        "summary": "Look up multiple IP addresses",
        "description": "Submit between 1 and 100 IP addresses. The full batch quota is reserved atomically and each submitted item counts as one monthly lookup. Invalid addresses return an item-level error.",
        "operationId": "lookupIpBatch",
        "security": [{ "ApiKeyAuth": [] }],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "array",
                "minItems": 1,
                "maxItems": 100,
                "items": { "type": "string" },
                "examples": [["8.8.8.8", "1.1.1.1"]]
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "One result or item-level error for each submitted address, in input order.",
            "headers": {
              "X-Quota-Limit": { "$ref": "#/components/headers/QuotaLimit" },
              "X-Quota-Remaining": { "$ref": "#/components/headers/QuotaRemaining" }
            },
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "oneOf": [
                      { "$ref": "#/components/schemas/GeoIpResult" },
                      { "$ref": "#/components/schemas/BatchItemError" }
                    ]
                  }
                }
              }
            }
          },
          "400": { "$ref": "#/components/responses/BadRequest" },
          "401": { "$ref": "#/components/responses/Unauthorized" },
          "429": { "$ref": "#/components/responses/QuotaExceeded" },
          "500": { "$ref": "#/components/responses/ServerError" }
        }
      }
    },
    "/api/auth/login": {
      "post": {
        "tags": ["Authentication"],
        "summary": "Log in to a customer account",
        "description": "Exchange account credentials for a JWT. Customer accounts are provisioned by iplocus; public registration is disabled by default.",
        "operationId": "login",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": { "$ref": "#/components/schemas/LoginRequest" },
              "examples": {
                "login": {
                  "value": { "email": "you@example.com", "password": "your-password" }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Authenticated account and JWT.",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthResponse" } } }
          },
          "400": { "$ref": "#/components/responses/BadRequest" },
          "401": { "description": "The email or password is invalid.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiError" } } } },
          "429": { "$ref": "#/components/responses/TooManyRequests" },
          "500": { "$ref": "#/components/responses/ServerError" }
        }
      }
    },
    "/api/keys": {
      "get": {
        "tags": ["API keys"],
        "summary": "List API keys",
        "description": "Returns key metadata and prefixes. Raw key values are never returned by this endpoint.",
        "operationId": "listApiKeys",
        "security": [{ "BearerAuth": [] }],
        "responses": {
          "200": {
            "description": "Keys belonging to the authenticated account.",
            "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ApiKey" } } } }
          },
          "401": { "$ref": "#/components/responses/Unauthorized" },
          "500": { "$ref": "#/components/responses/ServerError" }
        }
      },
      "post": {
        "tags": ["API keys"],
        "summary": "Create an API key",
        "description": "The raw key is returned exactly once. Store it securely before leaving the response.",
        "operationId": "createApiKey",
        "security": [{ "BearerAuth": [] }],
        "requestBody": {
          "required": true,
          "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateApiKeyRequest" } } }
        },
        "responses": {
          "201": {
            "description": "Created key. Save its raw value; it cannot be retrieved again.",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreatedApiKey" } } }
          },
          "400": { "$ref": "#/components/responses/BadRequest" },
          "401": { "$ref": "#/components/responses/Unauthorized" },
          "500": { "$ref": "#/components/responses/ServerError" }
        }
      }
    },
    "/api/keys/{id}": {
      "delete": {
        "tags": ["API keys"],
        "summary": "Revoke an API key",
        "operationId": "revokeApiKey",
        "security": [{ "BearerAuth": [] }],
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "description": "UUID of a key owned by the authenticated account.",
            "schema": { "type": "string", "format": "uuid" }
          }
        ],
        "responses": {
          "204": { "description": "Key revoked; no response body." },
          "401": { "$ref": "#/components/responses/Unauthorized" },
          "404": { "description": "Key not found for this account." },
          "500": { "$ref": "#/components/responses/ServerError" }
        }
      }
    },
    "/api/account/usage": {
      "get": {
        "tags": ["Account"],
        "summary": "Get plan and monthly usage",
        "operationId": "getAccountUsage",
        "security": [{ "BearerAuth": [] }],
        "responses": {
          "200": {
            "description": "Current plan and calendar-month quota usage.",
            "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountUsage" } } }
          },
          "401": { "$ref": "#/components/responses/Unauthorized" },
          "404": { "description": "Account not found." },
          "500": { "$ref": "#/components/responses/ServerError" }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "ApiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-Api-Key",
        "description": "Lookup key created from your account. Keep it server-side."
      },
      "BearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT",
        "description": "JWT returned by POST /api/auth/login."
      }
    },
    "headers": {
      "QuotaLimit": {
        "description": "Monthly lookup allowance for the account.",
        "schema": { "type": "integer" }
      },
      "QuotaRemaining": {
        "description": "Remaining monthly lookups after this request.",
        "schema": { "type": "integer" }
      }
    },
    "responses": {
      "BadRequest": {
        "description": "The request payload or IP address is invalid.",
        "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiError" } } }
      },
      "Unauthorized": {
        "description": "Credentials are missing, invalid, expired, or revoked.",
        "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiError" } } }
      },
      "QuotaExceeded": {
        "description": "The account's monthly quota does not have enough remaining lookups.",
        "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MonthlyQuotaError" } } }
      },
      "TooManyRequests": {
        "description": "A request-rate limit was reached. Retry after a short delay.",
        "headers": {
          "Retry-After": {
            "description": "Retry delay in seconds when provided by the service.",
            "schema": { "type": "integer" }
          }
        },
        "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiError" } } }
      },
      "ServerError": {
        "description": "Temporary service error.",
        "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiError" } } }
      }
    },
    "schemas": {
      "GeoIpResult": {
        "type": "object",
        "required": ["ip", "ipDecimal", "countryId", "country", "countryCode", "city", "region", "postal", "latitude", "longitude", "timezone", "asn", "asnOrg"],
        "properties": {
          "ip": { "type": "string", "description": "Canonical IP address resolved." },
          "ipDecimal": { "type": ["integer", "null"], "format": "int64", "description": "32-bit integer for IPv4, otherwise null." },
          "countryId": { "type": "integer", "description": "Internal country identifier. Current data returns 0 for US addresses." },
          "country": { "type": ["string", "null"] },
          "countryCode": { "type": ["string", "null"], "description": "ISO 3166-1 alpha-2." },
          "city": { "type": ["string", "null"] },
          "region": { "type": ["string", "null"], "description": "First-level subdivision." },
          "postal": { "type": ["string", "null"] },
          "latitude": { "type": ["number", "null"], "description": "Approximate network location, not GPS." },
          "longitude": { "type": ["number", "null"], "description": "Approximate network location, not GPS." },
          "timezone": { "type": ["string", "null"], "description": "IANA time zone." },
          "asn": { "type": ["integer", "null"], "format": "int64" },
          "asnOrg": { "type": ["string", "null"] },
          "demo": { "type": "boolean", "description": "Present only in the backend's local development fallback." }
        }
      },
      "BatchItemError": {
        "type": "object",
        "required": ["ip", "error"],
        "properties": {
          "ip": { "type": "string" },
          "error": { "type": "string", "examples": ["Invalid IP address."] }
        }
      },
      "LoginRequest": {
        "type": "object",
        "required": ["email", "password"],
        "properties": {
          "email": { "type": "string", "format": "email" },
          "password": { "type": "string", "format": "password" }
        }
      },
      "AuthResponse": {
        "type": "object",
        "required": ["token", "email", "plan"],
        "properties": {
          "token": { "type": "string", "description": "Account JWT for key and usage endpoints." },
          "email": { "type": "string", "format": "email" },
          "plan": { "type": "string" }
        }
      },
      "CreateApiKeyRequest": {
        "type": "object",
        "required": ["name"],
        "properties": {
          "name": { "type": "string", "maxLength": 64 }
        }
      },
      "ApiKey": {
        "type": "object",
        "required": ["id", "name", "prefix", "createdAt", "isActive"],
        "properties": {
          "id": { "type": "string", "format": "uuid" },
          "name": { "type": "string" },
          "prefix": { "type": "string", "description": "Visible prefix only; not the raw API key." },
          "createdAt": { "type": "string", "format": "date-time" },
          "lastUsedAt": { "type": ["string", "null"], "format": "date-time" },
          "isActive": { "type": "boolean" }
        }
      },
      "CreatedApiKey": {
        "type": "object",
        "required": ["id", "name", "key", "createdAt"],
        "properties": {
          "id": { "type": "string", "format": "uuid" },
          "name": { "type": "string" },
          "key": { "type": "string", "description": "Raw key. Returned once only." },
          "createdAt": { "type": "string", "format": "date-time" }
        }
      },
      "AccountUsage": {
        "type": "object",
        "required": ["plan", "monthlyQuota", "used", "remaining"],
        "properties": {
          "plan": { "type": "string" },
          "monthlyQuota": { "type": "integer" },
          "used": { "type": "integer" },
          "remaining": { "type": "integer" }
        }
      },
      "ApiError": {
        "type": "object",
        "properties": {
          "error": { "type": "string" },
          "detail": { "type": "string" },
          "title": { "type": "string" },
          "status": { "type": "integer" },
          "errors": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } }
        }
      },
      "MonthlyQuotaError": {
        "type": "object",
        "required": ["error", "monthlyQuota", "used", "requested"],
        "properties": {
          "error": { "type": "string", "examples": ["Monthly quota exceeded."] },
          "monthlyQuota": { "type": "integer" },
          "used": { "type": "integer" },
          "requested": { "type": "integer" }
        }
      }
    }
  }
}