openapi: 3.1.0
info:
  title: Tango User Provisioning API (non-BU)
  version: "1.2"
  description: |
    Async REST API: same endpoint as the BU variant
    (`/v1/usermgmt/batch/users`) but for client environments without a
    Business Unit layer. The `brands[]` items omit `business_unit`.

    Creates, updates, or inactivates user accounts with Brand / Country /
    Region / Role / Entity-Security scoping. See companion BU spec for the
    full semantics (special cases for `user_type = GENERAL_USER`, the
    `status = "N"` inactivation path, and the Country = ALL convention all
    apply here too).
  x-direction: inbound
  x-source: Client System
  x-destination: Tango
servers:
  - url: https://api.tangoanalytics.com
    description: Production
  - url: https://testapi.tangoanalytics.com
    description: Test (SIT/UAT)
tags:
  - name: User Provisioning
  - name: Status
paths:
  /v1/usermgmt/batch/users:
    put:
      summary: Insert / update / inactivate users (async)
      operationId: putUsersBatchNonBU
      tags: [User Provisioning]
      parameters:
        - $ref: "#/components/parameters/XClient"
        - $ref: "#/components/parameters/XApiKey"
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UserBatchRequest"
      responses:
        "200":
          description: Accepted for async processing.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AcceptedResponse"
  /batch/status:
    get:
      summary: Poll processing status by gu_id
      description: |
        NOTE: source documents `/batch/status` (no `/v1` prefix). Preserved
        verbatim; confirm.
      operationId: getBatchStatus
      tags: [Status]
      parameters:
        - $ref: "#/components/parameters/XClient"
        - $ref: "#/components/parameters/XApiKey"
        - in: query
          name: gu_id
          required: true
          schema: { type: string, format: uuid }
      responses:
        "200":
          description: Status payload.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/StatusResponse"
components:
  securitySchemes:
    xClientHeader: { type: apiKey, in: header, name: x-client }
    xApiKeyHeader: { type: apiKey, in: header, name: x-api-key }
  parameters:
    XClient:
      name: x-client
      in: header
      required: true
      schema: { type: string }
    XApiKey:
      name: x-api-key
      in: header
      required: true
      schema: { type: string }
  schemas:
    UserBatchRequest:
      type: object
      required: [records]
      properties:
        records:
          type: array
          items:
            $ref: "#/components/schemas/UserRecord"
    UserRecord:
      type: object
      required:
        - user_name
        - status
      properties:
        user_name: { type: string }
        first_name: { type: string, description: "Required for create/update." }
        last_name: { type: string, description: "Required for create/update." }
        email: { type: string, format: email, description: "Required for create/update." }
        user_type:
          type: string
          enum: [CONTRACTOR, CORPORATE, GENERAL_USER]
        sso:
          type: string
          enum: [Y, N]
        status:
          type: string
          enum: [A, N]
        title: { type: string }
        location: { type: string }
        default_brand: { type: string }
        default_country: { type: string }
        data_access_level:
          type: string
          enum: [F, R, RR]
        brands:
          type: array
          items:
            $ref: "#/components/schemas/BrandAssignment"
    BrandAssignment:
      type: object
      required:
        - brand_name
        - country
        - region
        - roles
      description: |
        Non-BU variant: no `business_unit` field. The rest of the assignment
        mirrors the BU variant.
      properties:
        brand_name: { type: string }
        country:
          type: string
          description: "`ALL` or comma-separated ISO 3-letter codes."
        region:
          type: string
          description: "`ALL` or comma-separated region identifiers."
        roles:
          type: string
          description: Tango Profile Name(s). Comma-separated for multi-role.
        entity_security:
          type: array
          items:
            $ref: "#/components/schemas/EntitySecurity"
    EntitySecurity:
      type: object
      required: [entity_type, full_access]
      properties:
        entity_type:
          type: string
          enum: [LEASE, PROJECT]
        full_access:
          type: string
          enum: [Y, N]
        restrictions:
          type: array
          items:
            type: object
            required: [attribute, value]
            properties:
              attribute:
                type: string
                enum: [SEC_ATTR1, SEC_ATTR2]
              value: { type: string }
    AcceptedResponse:
      type: object
      required: [status, gu_id]
      properties:
        status: { type: string, enum: [OK, Error] }
        status_message: { type: string }
        gu_id: { type: string, format: uuid }
    StatusResponse:
      oneOf:
        - type: object
          properties:
            status: { type: string, const: PROCESSING }
        - type: object
          required: [status, total_records]
          properties:
            status: { type: string, const: COMPLETED }
            total_records: { type: integer }
            errors: { type: 'null' }
        - type: object
          required: [status, total_records, errors]
          properties:
            status: { type: string, const: ERROR }
            total_records: { type: integer }
            errors:
              type: array
              items:
                type: object
                required: [record_index, error]
                properties:
                  record_index: { type: integer }
                  record_key: { type: string }
                  error: { type: string }
security:
  - xClientHeader: []
    xApiKeyHeader: []