{
  "order": {
    "x-owner": "marketplace",
    "parameters": [
      {
        "name": "id",
        "in": "path",
        "required": true,
        "description": "The new Order's ID, which the browser creates and keeps until it sees an answer.",
        "schema": {
          "type": "string",
          "format": "uuid"
        }
      }
    ],
    "post": {
      "operationId": "placeOrder",
      "summary": "Place an order",
      "description": "Places one Order for a catalogue pack in a Project. The buyer is the signed-in Party, never a body field, and the price comes from the catalogue. A retry with the same Idempotency-Key returns the recorded outcome.",
      "security": [
        {
          "PartySession": []
        },
        {
          "MCPAssertion": []
        }
      ],
      "parameters": [
        {
          "name": "Idempotency-Key",
          "in": "header",
          "required": true,
          "description": "Command identity: repeat it unchanged when retrying an uncertain request.",
          "schema": {
            "type": "string",
            "format": "uuid"
          }
        },
        {
          "name": "If-Match",
          "in": "header",
          "required": true,
          "description": "0, because the Order is new.",
          "schema": {
            "type": "string"
          }
        }
      ],
      "requestBody": {
        "required": true,
        "content": {
          "application/json": {
            "schema": {
              "$ref": "schemas.json#/schemas/PlaceOrder"
            },
            "example": {
              "project_id": "4f6b2c1e-8a3d-4e5f-9b7c-2d1e0f3a4b5c",
              "pack_id": "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d"
            }
          }
        }
      },
      "responses": {
        "200": {
          "description": "The Order was placed",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "../../shared/http_api/schemas.json#/schemas/CommandOutcome"
              },
              "example": {
                "aggregateId": "7d1f6a2e-3b4c-4d5e-8f9a-0b1c2d3e4f5a",
                "version": 1,
                "status": "placed"
              }
            }
          }
        },
        "400": {
          "description": "An identity header is not a UUID, or the body fails the schema",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "../../shared/http_api/schemas.json#/schemas/Error"
              },
              "example": {
                "code": "invalid_request"
              }
            }
          }
        },
        "401": {
          "description": "The session is missing or has expired",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "../../shared/http_api/schemas.json#/schemas/Error"
              },
              "example": {
                "code": "unauthorised"
              }
            }
          }
        },
        "403": {
          "description": "The request did not come from an allowed origin",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "../../shared/http_api/schemas.json#/schemas/Error"
              },
              "example": {
                "code": "origin_denied"
              }
            }
          }
        },
        "409": {
          "description": "The Order already exists, or the Idempotency-Key came with other input",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "../../shared/http_api/schemas.json#/schemas/CommandOutcome"
              },
              "example": {
                "aggregateId": "7d1f6a2e-3b4c-4d5e-8f9a-0b1c2d3e4f5a",
                "version": 1,
                "status": "",
                "rejection": {
                  "code": "version_conflict",
                  "message": "The expected aggregate version is stale"
                }
              }
            }
          }
        },
        "422": {
          "description": "Marketplace refused the Order: the pack is not in the catalogue, or the caller is not a buyer of the Project",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "../../shared/http_api/schemas.json#/schemas/CommandOutcome"
              },
              "example": {
                "aggregateId": "7d1f6a2e-3b4c-4d5e-8f9a-0b1c2d3e4f5a",
                "version": 0,
                "status": "",
                "rejection": {
                  "code": "pack_not_in_catalogue",
                  "message": "The pack is not in the catalogue"
                }
              }
            }
          }
        },
        "428": {
          "description": "If-Match is required",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "../../shared/http_api/schemas.json#/schemas/Error"
              },
              "example": {
                "code": "expected_version_required"
              }
            }
          }
        },
        "503": {
          "$ref": "../../shared/http_api/responses.json#/responses/503"
        }
      }
    }
  },
  "projectOrders": {
    "x-owner": "marketplace",
    "parameters": [
      {
        "name": "projectId",
        "in": "path",
        "required": true,
        "schema": {
          "type": "string",
          "format": "uuid"
        }
      }
    ],
    "get": {
      "operationId": "listProjectOrders",
      "summary": "List a Project's orders",
      "description": "Returns one page of the Project's Orders as they are stored now, ordered by Order ID. Only a buyer of the Project may list them, because other members can't see its costs. The caller is the signed-in Party.",
      "security": [
        {
          "PartySession": []
        },
        {
          "MCPAssertion": []
        }
      ],
      "parameters": [
        {
          "name": "after",
          "in": "query",
          "required": false,
          "description": "The next_after value of the previous page; omit it for the first page.",
          "schema": {
            "type": "string",
            "format": "uuid"
          }
        },
        {
          "name": "page_size",
          "in": "query",
          "required": false,
          "description": "Orders per page; 50 when omitted.",
          "schema": {
            "type": "integer",
            "minimum": 1,
            "maximum": 100
          }
        }
      ],
      "responses": {
        "200": {
          "description": "One page of the Project's Orders",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "schemas.json#/schemas/ProjectOrderPage"
              },
              "example": {
                "items": [
                  {
                    "order_id": "7d1f6a2e-3b4c-4d5e-8f9a-0b1c2d3e4f5a",
                    "revision": 1,
                    "ordered_by": "b7e238ad-b6ee-41e4-b99c-a697f988a47b",
                    "pack_id": "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d",
                    "price_minor": 150000,
                    "currency": "EUR",
                    "amount": 10,
                    "status": "placed"
                  }
                ],
                "next_after": null
              }
            }
          }
        },
        "400": {
          "description": "The Project ID, after or page_size is invalid",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "../../shared/http_api/schemas.json#/schemas/Error"
              },
              "example": {
                "code": "invalid_input"
              }
            }
          }
        },
        "401": {
          "description": "The session is missing or has expired",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "../../shared/http_api/schemas.json#/schemas/Error"
              },
              "example": {
                "code": "unauthorised"
              }
            }
          }
        },
        "403": {
          "description": "The caller is not a member of the Project, or does not hold its buyer right",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "../../shared/http_api/schemas.json#/schemas/Error"
              },
              "example": {
                "code": "no_buyer_right"
              }
            }
          }
        },
        "503": {
          "$ref": "../../shared/http_api/responses.json#/responses/503"
        }
      }
    }
  }
}