{"openapi":"3.1.0","info":{"title":"Hub City Design Order Management API","version":"1.0.0","summary":"Agent-facing endpoints of the Hub City Design order management system.","description":"The private order management system for Hub City Design, an apparel decoration and promotional products shop in Lubbock, Texas.\n\nAgents connect through one Model Context Protocol endpoint and act as the staff member who signed in. That person's live permissions decide every request, inside the scope the token was granted.\n\nThe internal REST routes are not listed here. A connected agent discovers them through the MCP route-discovery tool.","contact":{"name":"Hub City Design","url":"https://goprint.hubcitydesignlbk.com"}},"externalDocs":{"description":"Connector guide","url":"https://goprint.hubcitydesignlbk.com/docs/integrations/claude-mcp"},"servers":[{"url":"https://goprint.hubcitydesignlbk.com"}],"tags":[{"name":"MCP","description":"Model Context Protocol over Streamable HTTP."},{"name":"Status","description":"Deployment health."}],"paths":{"/api/mcp":{"post":{"operationId":"sendMcpMessage","tags":["MCP"],"summary":"Send a Model Context Protocol message","description":"JSON-RPC 2.0 over MCP Streamable HTTP. A token with `oms:read` reaches the read and preview tools. The tools that change records also need `oms:write`.","security":[{"omsOAuth":["oms:read"]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/JsonRpcMessage"}}}},"responses":{"200":{"description":"JSON-RPC response, as JSON or as a server-sent event stream.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JsonRpcMessage"}},"text/event-stream":{"schema":{"type":"string"}}}},"202":{"description":"Notification or response accepted. No body."},"400":{"description":"The body is not valid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Missing, expired, or revoked access token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}},"headers":{"WWW-Authenticate":{"description":"Bearer challenge naming the RFC 9728 metadata document and the scope to request.","schema":{"type":"string"}}}},"403":{"description":"The request origin is not allowed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"413":{"description":"The body is larger than 1 MB.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"415":{"description":"The body is not application/json.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/api/version":{"get":{"operationId":"getVersion","tags":["Status"],"summary":"Deployment health","description":"Which build is running. Holds no credentials and no customer data.","security":[],"responses":{"200":{"description":"Deployment details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Version"}}}}}}}},"components":{"securitySchemes":{"omsOAuth":{"type":"oauth2","description":"OAuth 2.0 authorization code flow with PKCE (S256). The staff member signs in and approves the scopes. Tokens are bound to the MCP endpoint (RFC 8707). Server metadata: /.well-known/oauth-authorization-server. Resource metadata: /.well-known/oauth-protected-resource/api/mcp.","flows":{"authorizationCode":{"authorizationUrl":"https://goprint.hubcitydesignlbk.com/api/mcp/oauth/authorize","tokenUrl":"https://goprint.hubcitydesignlbk.com/api/mcp/oauth/token","refreshUrl":"https://goprint.hubcitydesignlbk.com/api/mcp/oauth/token","scopes":{"oms:read":"Read orders, quotes, customers, and other records, and preview a change without sending it.","oms:write":"Create, update, and delete records. The signed-in staff member's own permissions still decide each request."}}}}},"schemas":{"Error":{"type":"object","required":["error","message"],"properties":{"error":{"type":"string"},"message":{"type":"string"}}},"JsonRpcMessage":{"description":"A JSON-RPC 2.0 request, notification, or response, or a batch of them.","oneOf":[{"$ref":"#/components/schemas/JsonRpcObject"},{"type":"array","items":{"$ref":"#/components/schemas/JsonRpcObject"}}]},"JsonRpcObject":{"type":"object","required":["jsonrpc"],"properties":{"jsonrpc":{"const":"2.0"},"id":{"type":["string","integer","null"]},"method":{"type":"string"},"params":{"type":["object","array"]},"result":{},"error":{"type":"object"}}},"Version":{"type":"object","required":["commit","branch","env","databaseTarget","outboundBlocked"],"properties":{"commit":{"type":"string"},"branch":{"type":"string"},"env":{"type":"string"},"nodeEnv":{"type":"string"},"deployedAt":{"type":["string","null"]},"region":{"type":["string","null"]},"databaseTarget":{"type":"string"},"outboundBlocked":{"type":"boolean"},"liveProviderKeys":{"type":"object","description":"How many live provider keys this deployment holds, as a count only; this route is public, so key names are withheld. A preview or development deployment should report present 0. In production, present should equal the number of inventory keys configured for Production.","required":["present","total"],"properties":{"present":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0}},"additionalProperties":false}}}}}}