{
  "openapi": "3.1.0",
  "info": {"title": "Bombyx internal call activity", "version": "1.0.0", "description": "Session-protected web UI telemetry, not a supported public dialing or tool-connectors API."},
  "servers": [{"url": "https://bombyxlabs.com"}],
  "paths": {
    "/app/calls/usage": {
      "post": {
        "summary": "Record a browser call demo start",
        "operationId": "recordBrowserCallDemoStart",
        "description": "Records only browser demo type and server start time. Deduplicated within the web session and surface by event_id. Uses the site's current session cookie and CSRF token. Limited to 10/minute and 60/hour per IP. Does not dial or retain conversation content.",
        "security": [{"WebSession": [], "CsrfToken": []}],
        "requestBody": {"required": true, "content": {"application/json": {"schema": {"type": "object", "required": ["surface", "event_id"], "properties": {"surface": {"type": "string", "enum": ["guided_practice", "inbound_practice"]}, "event_id": {"type": "string", "format": "uuid"}}}}}},
        "responses": {"204": {"description": "Recorded or already recorded; no event details are exposed."}, "419": {"description": "Missing or invalid CSRF token."}, "403": {"description": "Failed browser-origin check."}, "422": {"description": "Invalid demo surface or event UUID."}, "429": {"description": "Too many requests."}}
      }
    },
    "/app/admin/call-usage/{event}": {
      "get": {
        "summary": "Open private call activity details",
        "operationId": "viewAdminCallActivity",
        "description": "Requires sign-in and system-admin access. Real call activity redirects to the existing authorized Guided detail or Incoming desk with the exact selected call. Browser demos and missing call records render a minimal private HTML activity page.",
        "security": [{"WebSession": []}],
        "parameters": [{"name": "event", "in": "path", "required": true, "schema": {"type": "string", "format": "uuid"}}],
        "responses": {"200": {"description": "Private activity HTML; no-store."}, "302": {"description": "Sign-in or existing scoped call detail redirect."}, "403": {"description": "System admin access required."}, "404": {"description": "Unknown event."}}
      }
    }
  },
  "components": {"securitySchemes": {"WebSession": {"type": "apiKey", "in": "cookie", "name": "bombyx_chatbot_session", "description": "Deployment-configured SESSION_COOKIE; use the existing same-origin browser session."}, "CsrfToken": {"type": "apiKey", "in": "header", "name": "X-CSRF-TOKEN", "description": "Current CSRF token supplied by the demo page."}}}
}