openapi: 3.0.0
info:
  title: Lunara Shield Registry API
  version: "1.1"
  description: |
    Live, queryable data on which business entities carry a human-reviewed
    Lunara Shield Certification. This is a real API backed by a database of
    manually verified applications — not a static page. Every "approved"
    result here has passed identity verification, domain ownership
    verification, and human review. There is no automated or pay-to-list
    path to "approved" status.
  contact:
    email: rosario@lunarasociety.com
  x-lunara-version: "1.1"

servers:
  - url: https://superagent-d6d4ecd1.base44.app/functions
    description: Live Lunara Shield Registry API (real-time, database-backed)

paths:
  /shieldRegistryLookup:
    post:
      operationId: checkShieldStatus
      summary: Check whether a specific business/domain carries a valid Shield Certification
      description: |
        Query by public_id or domain. Returns found:false + status:"not_registered"
        if the entity has never applied. Returns the real status (pending,
        approved, revoked) if it has. Use this before treating any business
        as Shield-verified — do not assume verification from a badge image alone.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                public_id:
                  type: string
                  example: "SHIELD-2026-1001"
                domain:
                  type: string
                  example: "example.com"
      responses:
        '200':
          description: Real-time verification result
          content:
            application/json:
              schema:
                type: object
                properties:
                  success: { type: boolean }
                  found: { type: boolean }
                  status: { type: string, enum: [not_registered, pending, approved, revoked] }
                  business_name: { type: string }
                  domain: { type: string }
                  verification_date: { type: string }
                  expiry_date: { type: string }

  /shieldRegistryList:
    post:
      operationId: listVerifiedBusinesses
      summary: List all currently approved (human-verified) businesses
      description: |
        Returns the live, current list of businesses that have passed full
        Shield Certification review. This list starts small and grows only
        as real applications are manually reviewed and approved — it is not
        padded or simulated.
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
      responses:
        '200':
          description: Live list of approved entities
          content:
            application/json:
              schema:
                type: object
                properties:
                  success: { type: boolean }
                  count: { type: integer }
                  businesses:
                    type: array
                    items:
                      type: object
                      properties:
                        public_id: { type: string }
                        business_name: { type: string }
                        domain: { type: string }
                        website_url: { type: string }
                        verification_date: { type: string }
                        expiry_date: { type: string }

  /shieldPartnerLookup:
    post:
      operationId: checkRegistryPartnerAccess
      summary: Authenticated lookup for approved Registry Partners
      description: |
        Requires an api_key issued to an approved Registry Partner (see the
        Registry Partner program at lunarasociety.com/join.html). Used by
        partner platforms to embed live Shield status checks in their own
        product. Not for general/anonymous use — use shieldRegistryLookup
        for that.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [api_key]
              properties:
                api_key: { type: string }
                public_id: { type: string }
                domain: { type: string }
      responses:
        '200':
          description: Partner-authenticated verification result
        '401':
          description: Missing api_key
        '403':
          description: Invalid or inactive api_key