openapi: 3.1.0
info:
  title: Tango User Provisioning (non-BU) — File
  version: "1.4"
  description: |
    SFTP file-based inbound. Client drops a JSON-format file (note: NOT
    pipe-delimited like other file integrations) containing user-provisioning
    records to Tango's SFTP server. Same semantics as the non-BU API variant —
    creates, updates, or inactivates users with Brand / Country / Region /
    Role scoping (no Business Unit layer).

    NOTE: file extension is `.json` per the source naming convention, not
    `.txt` as other Tango file integrations use. Wire format inside is JSON,
    not pipe-delimited.
  x-direction: inbound
  x-source: Client System
  x-destination: Tango
  x-transport: sftp
  x-file-format: JSON (.json)
  x-file-naming-convention: "{ClientCode}_user_prov_non_bu_MMDDYYYYHHMMS.json"
servers:
  - url: sftp://sftp.tangoanalytics.com
    description: Production SFTP
    x-environment: production
    x-path: /inbound/User_Provisioning
  - url: sftp://sftpdev.tangoanalytics.com
    description: Test SFTP (SIT/UAT)
    x-environment: test
    x-path: /inbound/User_Provisioning
tags:
  - name: User Provisioning File
paths:
  /inbound/User_Provisioning:
    post:
      summary: Drop user provisioning JSON file at SFTP path
      operationId: deliverUserProvisioningFile
      tags: [User Provisioning File]
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UserBatchPayload"
      responses:
        "200":
          description: File received and queued for processing.
components:
  securitySchemes:
    sftpUserPassword:
      type: http
      scheme: basic
  schemas:
    UserBatchPayload:
      type: object
      required: [records]
      properties:
        records:
          type: array
          items:
            $ref: "#/components/schemas/UserRecord"
    UserRecord:
      type: object
      required:
        - user_name
        - status
      properties:
        user_name:
          type: string
          description: User identifier.
        first_name: { type: string, description: "Required for create/update." }
        last_name: { type: string, description: "Required for create/update." }
        email: { type: string, format: email, description: "Required for create/update." }
        user_type:
          type: string
          enum: [CONTRACTOR, CORPORATE, GENERAL_USER]
          description: "Defaults to CORPORATE if blank."
        sso:
          type: string
          enum: [Y, N]
        status:
          type: string
          enum: [A, N]
        title: { type: string }
        location: { type: string }
        default_country: { type: string }
        default_brand: { type: string }
        data_access_level:
          type: string
          enum: [F, R, RR]
        brands:
          type: array
          items:
            $ref: "#/components/schemas/BrandAssignment"
    BrandAssignment:
      type: object
      required:
        - brand_name
        - country
        - region
        - roles
      properties:
        brand_name: { type: string }
        country:
          type: string
          description: "`ALL` or comma-separated ISO 3-letter codes."
        region:
          type: string
          description: "`ALL` or comma-separated region identifiers."
        roles:
          type: string
          description: Configured client role name(s). Blank when `user_type = GENERAL_USER`.
        entity_security:
          type: array
          items:
            type: object
            required: [entity_type, full_access]
            properties:
              entity_type:
                type: string
                enum: [LEASE, PROJECT]
              full_access:
                type: string
                enum: [Y, N]
              restrictions:
                type: array
                items:
                  type: object
                  required: [attribute, value]
                  properties:
                    attribute:
                      type: string
                      enum: [SEC_ATTR1, SEC_ATTR2]
                    value: { type: string }
security:
  - sftpUserPassword: []