openapi: 3.1.0
info:
  title: nodestr API
  version: 0.2.0
  description: |
    Prepaid cloud VPS API for nodestr.cloud.
    Customer auth via NIP-98 (Nostr HTTP Auth). Private keys never sent to server.
    Agent skill: /agent-skill.md
servers:
  - url: https://nodestr.cloud
    description: Production
  - url: http://localhost:3000
    description: Local dev
paths:
  /v1/health:
    get:
      summary: Health check
      responses:
        '200':
          description: OK
  /v1/config:
    get:
      summary: Public config
      responses:
        '200':
          description: markup_percent, payments_enabled, vapid_public_key
  /v1/plans:
    get:
      summary: VPS catalog
      responses:
        '200':
          description: Plans grouped by product line with config_options and pricing
  /v1/rates:
    get:
      summary: BTC/USD spot rate
      responses:
        '200':
          description: Current or cached rate
  /v1/orders/quote:
    post:
      summary: Live price quote (no auth)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrderRequest'
      responses:
        '200':
          description: retail_usd, amount_sats, btc_usd
        '422':
          description: preview_failed / unavailable
  /v1/orders:
    post:
      summary: Create order (pending_payment — no invoice yet)
      security:
        - nip98: []
        - apiKey: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrderRequest'
      responses:
        '200':
          description: Order created in pending_payment
        '401':
          description: Auth failed
    get:
      summary: List customer orders
      security:
        - nip98: []
        - apiKey: []
      responses:
        '200':
          description: Order list
  /v1/orders/{id}:
    get:
      summary: Order status, progress, VM if ready, payment if unpaid
      security:
        - nip98: []
        - apiKey: []
      parameters:
        - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: Order detail
  /v1/orders/{id}/pay:
    post:
      summary: Request Lightning invoice or ndebit pull for unpaid order
      security:
        - nip98: []
        - apiKey: []
      parameters:
        - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: Order with payment.bolt11 or advanced status after ndebit
        '503':
          description: payments_unavailable
  /v1/orders/{id}/cancel:
    post:
      summary: Cancel unpaid order
      security:
        - nip98: []
        - apiKey: []
      parameters:
        - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: Canceled
        '400':
          description: Only pending_payment orders can be canceled
  /v1/vms:
    get:
      summary: List customer VMs
      security:
        - nip98: []
        - apiKey: []
      responses:
        '200':
          description: VM list with ssh_hint, manage, manageable
  /v1/vms/{id}:
    get:
      summary: VM detail
      security:
        - nip98: []
        - apiKey: []
      parameters:
        - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: VM detail + manage context
  /v1/vms/{id}/credentials:
    get:
      summary: Root password when no SSH key configured
      security:
        - nip98: []
        - apiKey: []
      parameters:
        - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: os_user, password
        '400':
          description: ssh_key_only
        '503':
          description: password_unavailable
  /v1/vms/{id}/upgrade/preview:
    post:
      summary: Preview resource upgrade pricing
      security:
        - nip98: []
        - apiKey: []
      parameters:
        - $ref: '#/components/parameters/Id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpgradeRequest'
      responses:
        '200':
          description: Retail due, recurring, shortfall_usd, balance_usd
  /v1/vms/{id}/upgrade:
    patch:
      summary: Apply resource upgrade (wallet debit)
      security:
        - nip98: []
        - apiKey: []
      parameters:
        - $ref: '#/components/parameters/Id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpgradeRequest'
      responses:
        '200':
          description: Upgrade queued
        '402':
          description: insufficient_balance (shortfall_usd, amount_due_usd, balance_usd)
  /v1/vms/{id}/start:
    patch:
      summary: Start VM
      security:
        - nip98: []
        - apiKey: []
      parameters:
        - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: Updated VM
  /v1/vms/{id}/stop:
    patch:
      summary: Stop VM
      security:
        - nip98: []
        - apiKey: []
      parameters:
        - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: Updated VM
  /v1/vms/{id}/restart:
    patch:
      summary: Restart VM
      security:
        - nip98: []
        - apiKey: []
      parameters:
        - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: Updated VM
  /v1/vms/{id}/reinstall:
    patch:
      summary: Reinstall OS
      security:
        - nip98: []
        - apiKey: []
      parameters:
        - $ref: '#/components/parameters/Id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [template]
              properties:
                template:
                  type: string
                  description: Template value from manage.templates
      responses:
        '200':
          description: Reinstall started
  /v1/vms/{id}/ssh-key:
    post:
      summary: Apply SSH public key to running VM
      security:
        - nip98: []
        - apiKey: []
      parameters:
        - $ref: '#/components/parameters/Id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [ssh_key]
              properties:
                ssh_key:
                  type: string
      responses:
        '200':
          description: Key applied
  /v1/vms/{id}/cancel:
    post:
      summary: Cancel VM and stop billing
      security:
        - nip98: []
        - apiKey: []
      parameters:
        - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: VM canceled
  /v1/customers/me:
    get:
      summary: Current customer profile and balance
      security:
        - nip98: []
        - apiKey: []
      responses:
        '200':
          description: Customer + balance_usd
  /v1/customers/me/autopay:
    put:
      summary: Save or clear ndebit autopay pointer
      security:
        - nip98: []
        - apiKey: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                ndebit:
                  type: string
                  nullable: true
      responses:
        '200':
          description: Updated customer
  /v1/customers/me/topup:
    post:
      summary: Top up USD wallet
      security:
        - nip98: []
        - apiKey: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                amount_usd:
                  type: string
                  example: '10.00'
      responses:
        '200':
          description: paid true (ndebit) or bolt11 invoice
  /v1/customers/{id}/topup:
    post:
      summary: Top up (id must match authed customer)
      security:
        - nip98: []
        - apiKey: []
      parameters:
        - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: paid true or bolt11
  /v1/auth/api-key:
    post:
      summary: Mint long-lived API key (shown once)
      security:
        - nip98: []
      responses:
        '200':
          description: api_key
  /v1/push/subscribe:
    post:
      summary: Register web push subscription
      security:
        - nip98: []
        - apiKey: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required: [endpoint, keys]
              properties:
                endpoint:
                  type: string
                keys:
                  type: object
                  properties:
                    p256dh:
                      type: string
                    auth:
                      type: string
      responses:
        '200':
          description: Subscribed
components:
  parameters:
    Id:
      name: id
      in: path
      required: true
      schema:
        type: string
  securitySchemes:
    nip98:
      type: apiKey
      in: header
      name: Authorization
      description: |
        NIP-98: `Nostr <base64-json-event>`.
        Optional `debit` tag with ndebit1 pointer for pay/topup autopay.
        URL in `u` tag must match exactly; event age ≤ 60s.
    apiKey:
      type: apiKey
      in: header
      name: X-Api-Key
      description: Long-lived key from POST /v1/auth/api-key (no ndebit autopay)
  schemas:
    OrderRequest:
      type: object
      required: [hostname]
      properties:
        plan_id:
          type: string
          description: UUID from GET /v1/plans
        package_id:
          type: integer
          description: Alternate to plan_id — package id from catalog
        pricing_id:
          type: integer
          description: From plan pricing[]; omit for plan day default when available
        hostname:
          type: string
        ssh_key:
          type: string
        config_options:
          type: object
          description: |
            Keys are option_id strings from catalog config_options for the chosen period
            (not friendly names like "ram"). Values are the selected values[].value.
          additionalProperties:
            type: string
          example:
            '42': '32768'
            '43': '8'
    UpgradeRequest:
      type: object
      required: [pricing_ref, config_options]
      properties:
        pricing_ref:
          type: string
          description: From vm.manage.pricing_ref
        config_options:
          type: object
          description: Changed option_id → value only
          additionalProperties:
            type: string