openapi: 3.1.0
info:
  title: HealthService API
  version: 1.0.0
security:
  - WorldMonitorKey: []
  - ApiKeyHeader: []
servers:
  - url: https://api.worldmonitor.app
paths:
  /api/health/v1/list-disease-outbreaks:
    get:
      tags:
        - HealthService
      summary: ListDiseaseOutbreaks
      description: ListDiseaseOutbreaks returns recent WHO/ProMED disease outbreak alerts.
      operationId: ListDiseaseOutbreaks
      parameters:
        - name: jmespath
          in: query
          description: >-
            Optional JMESPath expression applied server-side to project or
            reduce the JSON response before it is returned (mirrors the MCP
            jmespath argument). Invalid expressions, expressions larger than
            1024 UTF-8 bytes, or projections that exceed the 256 KB output cap
            return HTTP 400 with a {_jmespath_error, original_keys} envelope.
            Grammar and worked examples:
            https://www.worldmonitor.app/docs/mcp-jmespath.
          required: false
          example: keys(@)
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              example:
                alertLevelMethodologyVersion: example
                fetchedAt: 1717200000000
                outbreaks:
                  - alertLevel: example
                    cases: 1
                    countryCode: US
                    disease: example
                    id: example-id
              schema:
                $ref: '#/components/schemas/ListDiseaseOutbreaksResponse'
        '400':
          description: Validation error
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/ValidationError'
                  - $ref: '#/components/schemas/JmespathProjectionError'
        '401':
          description: Missing or invalid API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedError'
        '403':
          description: >-
            API access requires an active subscription (the API key's
            subscription is inactive or expired).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenError'
        '429':
          description: Rate limit exceeded.
          headers:
            X-RateLimit-Limit:
              description: Maximum requests allowed in the active rate-limit window.
              schema:
                type: string
            X-RateLimit-Remaining:
              description: Requests remaining in the active rate-limit window.
              schema:
                type: string
            X-RateLimit-Reset:
              description: >-
                Unix epoch milliseconds when the active rate-limit window
                resets.
              schema:
                type: string
            Retry-After:
              description: Seconds to wait before retrying the request.
              schema:
                type: string
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Error'
                  - $ref: '#/components/schemas/RateLimitError'
        default:
          description: Gateway or handler error response.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Error'
                  - $ref: '#/components/schemas/GatewayError'
  /api/health/v1/list-air-quality-alerts:
    get:
      tags:
        - HealthService
      summary: ListAirQualityAlerts
      description: >-
        ListAirQualityAlerts returns recent PM2.5 stations with AQI-derived
        health risk.
      operationId: ListAirQualityAlerts
      parameters:
        - name: jmespath
          in: query
          description: >-
            Optional JMESPath expression applied server-side to project or
            reduce the JSON response before it is returned (mirrors the MCP
            jmespath argument). Invalid expressions, expressions larger than
            1024 UTF-8 bytes, or projections that exceed the 256 KB output cap
            return HTTP 400 with a {_jmespath_error, original_keys} envelope.
            Grammar and worked examples:
            https://www.worldmonitor.app/docs/mcp-jmespath.
          required: false
          example: keys(@)
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              example:
                alerts:
                  - aqi: 1
                    city: example
                    countryCode: US
                    lat: 40.7128
                    lng: -74.006
                fetchedAt: 1717200000000
              schema:
                $ref: '#/components/schemas/ListAirQualityAlertsResponse'
        '400':
          description: Validation error
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/ValidationError'
                  - $ref: '#/components/schemas/JmespathProjectionError'
        '401':
          description: Missing or invalid API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedError'
        '403':
          description: >-
            API access requires an active subscription (the API key's
            subscription is inactive or expired).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenError'
        '429':
          description: Rate limit exceeded.
          headers:
            X-RateLimit-Limit:
              description: Maximum requests allowed in the active rate-limit window.
              schema:
                type: string
            X-RateLimit-Remaining:
              description: Requests remaining in the active rate-limit window.
              schema:
                type: string
            X-RateLimit-Reset:
              description: >-
                Unix epoch milliseconds when the active rate-limit window
                resets.
              schema:
                type: string
            Retry-After:
              description: Seconds to wait before retrying the request.
              schema:
                type: string
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Error'
                  - $ref: '#/components/schemas/RateLimitError'
        default:
          description: Gateway or handler error response.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Error'
                  - $ref: '#/components/schemas/GatewayError'
components:
  securitySchemes:
    WorldMonitorKey:
      type: apiKey
      in: header
      name: X-WorldMonitor-Key
      description: User-issued WorldMonitor API key.
    ApiKeyHeader:
      type: apiKey
      in: header
      name: X-Api-Key
      description: Alias header for the WorldMonitor API key (X-WorldMonitor-Key).
  schemas:
    JmespathProjectionError:
      description: >-
        Returned when a REST jmespath projection is invalid or exceeds the
        expression/output byte limits.
      properties:
        _jmespath_error:
          description: Projection error discriminator and details.
          type: string
        original_keys:
          description: Top-level keys or shape of the unprojected response.
          items:
            type: string
          type: array
      required:
        - _jmespath_error
        - original_keys
      type: object
    UnauthorizedError:
      type: object
      properties:
        error:
          type: string
          description: Human-readable error message.
      required:
        - error
      description: >-
        Returned when the API key is missing, malformed, or lacks current API
        access.
    Error:
      type: object
      properties:
        message:
          type: string
          description: Error message (e.g., 'user not found', 'database connection failed')
      description: >-
        Error is returned when a handler encounters an error. It contains a
        simple error message that the developer can customize.
    InvalidRequestBodyError:
      type: object
      description: Returned when a JSON POST request body is empty or malformed.
      properties:
        message:
          type: string
          description: Invalid request body
      required:
        - message
    GatewayError:
      type: object
      description: >-
        Returned by gateway infrastructure errors before an RPC handler runs,
        such as origin, routing, method, authentication, or quota checks.
      properties:
        error:
          oneOf:
            - type: string
            - type: object
              additionalProperties: true
          description: Gateway error reason or structured gateway failure details.
      required:
        - error
    RateLimitError:
      type: object
      description: Returned when a gateway or handler rate limit rejects the request.
      properties:
        error:
          type: string
          description: Human-readable rate-limit failure reason.
      required:
        - error
    ForbiddenError:
      type: object
      properties:
        error:
          type: string
          description: Human-readable entitlement failure reason.
        requiredTier:
          type: integer
          format: int32
          description: Minimum entitlement tier required for this endpoint.
        currentTier:
          type: integer
          format: int32
          description: Caller entitlement tier when known.
        planKey:
          type: string
          description: Caller plan key when known.
      required:
        - error
      description: >-
        Returned when a PRO-gated endpoint denies access because the caller has
        no resolved authenticated user, entitlements cannot be verified, or the
        caller lacks the required entitlement tier.
    FieldViolation:
      type: object
      properties:
        field:
          type: string
          description: >-
            The field path that failed validation (e.g., 'user.email' for nested
            fields). For header validation, this will be the header name (e.g.,
            'X-API-Key')
        description:
          type: string
          description: >-
            Human-readable description of the validation violation (e.g., 'must
            be a valid email address', 'required field missing')
      required:
        - field
        - description
      description: FieldViolation describes a single validation error for a specific field.
    ValidationError:
      type: object
      properties:
        violations:
          type: array
          items:
            $ref: '#/components/schemas/FieldViolation'
          description: List of validation violations
      required:
        - violations
      description: >-
        ValidationError is returned when request validation fails. It contains a
        list of field violations describing what went wrong.
    ListDiseaseOutbreaksRequest:
      type: object
    ListDiseaseOutbreaksResponse:
      type: object
      properties:
        outbreaks:
          type: array
          items:
            $ref: '#/components/schemas/DiseaseOutbreakItem'
        fetchedAt:
          type: integer
          format: int64
          description: 'Warning: Values > 2^53 may lose precision in JavaScript'
        alertLevelMethodologyVersion:
          type: string
          description: >-
            Version of the editorial alert-level classifier (keyword sets,
            regexes,
             promotion rules) used to label each item's alert_level. Bumping this
             signals to downstream clients that the labelling rules changed so cached
             comparisons across versions are no longer apples-to-apples. See
             docs/methodology/disease-alert-level.mdx for the change protocol.
    DiseaseOutbreakItem:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier (URL-derived).
        disease:
          type: string
          description: Disease or outbreak name.
        location:
          type: string
          description: Affected country or region.
        countryCode:
          type: string
          description: ISO2 country code when known.
        alertLevel:
          type: string
          description: 'Alert level: "watch" | "warning" | "alert".'
        summary:
          type: string
          description: Short description from the source.
        sourceUrl:
          type: string
          description: Source URL.
        publishedAt:
          type: integer
          format: int64
          description: >-
            Unix epoch milliseconds when published.. Warning: Values > 2^53 may
            lose precision in JavaScript
        sourceName:
          type: string
          description: Source name (e.g., "WHO", "ProMED", "HealthMap").
        lat:
          type: number
          format: double
          description: >-
            Precise latitude from source (overrides country centroid on map when
            non-zero).
        lng:
          type: number
          format: double
          description: >-
            Precise longitude from source (overrides country centroid on map
            when non-zero).
        cases:
          type: integer
          format: int32
          description: Case count if reported by source (0 = unknown).
      description: DiseaseOutbreakItem represents a single disease outbreak event.
    ListAirQualityAlertsRequest:
      type: object
    ListAirQualityAlertsResponse:
      type: object
      properties:
        alerts:
          type: array
          items:
            $ref: '#/components/schemas/AirQualityAlert'
        fetchedAt:
          type: integer
          format: int64
          description: 'Warning: Values > 2^53 may lose precision in JavaScript'
    AirQualityAlert:
      type: object
      properties:
        city:
          type: string
        countryCode:
          type: string
        lat:
          type: number
          format: double
        lng:
          type: number
          format: double
        pm25:
          type: number
          format: double
        aqi:
          type: integer
          format: int32
        riskLevel:
          type: string
        pollutant:
          type: string
        measuredAt:
          type: integer
          format: int64
          description: 'Warning: Values > 2^53 may lose precision in JavaScript'
        source:
          type: string