openapi.yaml

openapi: 3.0.3
info:
  title: TooGoodToGo API
  description: Attempt to reverse-engineer the TooGoodToGo API
  version: 0.0.1

servers:
  - url: https://apptoogoodtogo.com/api
    description: Production (Nearest)
  - url: https://euw1.apptoogoodtogo.com/api
    description: Production (EU)
  - url: https://use1.apptoogoodtogo.com/api
    description: Production (US)

  - url: https://backend-staging.apptoogoodtogo.com/api
    description: Staging (Nearest)
  - url: https://backend-staging-euw1.apptoogoodtogo.com/api
    description: Staging (EU)
  - url: https://backend-staging-use1.apptoogoodtogo.com/api
    description: Staging (US)

  - url: https://gold-backend-internal.dev-euw1.tgtg.ninja/api
    description: Gold (EU) (Requires VPN)
  - url: https://gold-backend-internal.dev-use1.tgtg.ninja/api
    description: Gold (US) (Requires VPN)

  - url: https://backend-test1.apptoogoodtogo.com/api
    description: Test1 (EU)
  - url: https://backend-test1-use1.apptoogoodtogo.com/api
    description: Test1 (US)

  - url: https://backend-test2.apptoogoodtogo.com/api
    description: Test2 (EU)
  - url: https://backend-test2-use1.apptoogoodtogo.com/api
    description: Test2 (US)

  - url: https://backend-test3.apptoogoodtogo.com/api
    description: Test3 (EU)
  - url: https://backend-test3-use1.apptoogoodtogo.com/api
    description: Test3 (US)

  - url: https://backend-test4.apptoogoodtogo.com/api
    description: Test4 (EU)
  - url: https://backend-test4-use1.apptoogoodtogo.com/api
    description: Test4 (US)

  - url: https://backend-test5.apptoogoodtogo.com/api
    description: Test5 (EU)    
  - url: https://backend-test5-use1.apptoogoodtogo.com/api
    description: Test5 (US)

  - url: https://backend-test6.apptoogoodtogo.com/api
    description: Test6 (EU)
  - url: https://backend-test6-use1.apptoogoodtogo.com/api
    description: Test6 (US)

  - url: https://backend-test7.apptoogoodtogo.com/api
    description: Test7 (EU)
  - url: https://backend-test7-use1.apptoogoodtogo.com/api
    description: Test7 (US)

  - url: https://backend-test8.apptoogoodtogo.com/api
    description: Test8 (EU)
  - url: https://backend-test8-use1.apptoogoodtogo.com/api
    description: Test8 (US)

  - url: https://backend-test9.apptoogoodtogo.com/api
    description: Test9 (EU)
  - url: https://backend-test9-use1.apptoogoodtogo.com/api
    description: Test9 (US)

tags:
  - name: "app"
    description: ""
  - name: "auth"
    description: ""
  - name: "basket"
    description: ""
  - name: "gdpr"
    description: ""
  - name: "hiddenstore"
    description: ""
  - name: "item"
    description: ""
  - name: "location"
    description: ""
  - name: "map"
    description: ""
  - name: "order"
    description: ""
  - name: "payment"
    description: ""
  - name: "selfonboarding"
    description: ""
  - name: "store"
    description: ""
  - name: "support"
    description: ""
  - name: "tracking"
    description: ""
  - name: "user"
    description: ""
  - name: "voucher"
    description: ""

paths:
  /app/v1/app_settings:
    post:
      tags:
        - app
      summary: Get App settings

      parameters:
        - in: header
          name: Accept-Language
          schema:
            type: string
          required: true

      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppSettings'
        '400':
          description: Bad request. The Accept-Language header is required.

  /app/v1/user_settings:
    post:
      tags:
        - app
      summary: Get User settings
      security:
        - bearerAuth: []

      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserSettings'
        '400':
          description: Bad request. The Accept-Language header is required.
  
  /auth/v2/loginByEmail:
    post:
      tags:
        - auth
      summary: Logs in a user by email.

      requestBody:
        $ref: '#/components/requestBodies/LoginByEmailRequest'

      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginResponse'
        '400':
          description: VALIDATION_ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
        '403':
          description: FAILED_LOGIN
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'

  /auth/v2/logout:
    post:
      tags:
        - auth
      summary: Logs out (destroys the tokens)
      security:
        - bearerAuth: []

      responses:
        '200':
          description: OK
        '401':
          description: UNAUTHORIZED
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Errors'
                  - $ref: '#/components/schemas/Error'

  /hiddenstore/v2/unlock:
    post:
      tags:
        - hiddenstore
      summary: Unlock a hidden store
      security:
        - bearerAuth: []

      requestBody:
        $ref: '#/components/requestBodies/UnlockHiddenStoreRequest'

      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnlockHiddenStoreResponse'
        '400':
          description: VALIDATION_ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
        '401':
          description: UNAUTHORIZED
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Errors'
                  - $ref: '#/components/schemas/Error'
        '403':
          description: FORBIDDEN
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
        # happens if the given user_id doesn't match with the given bearer token
        # UNAUTHORIZED
        # Access is denied
  
  /auth/v2/token/refresh:
    post:
      tags:
        - auth
      summary: Refresh the access token

      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                refresh_token:
                  type: string
                  description: "Refresh token"
              required:
                - refresh_token

      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RefreshTokenResult'
        '400':
          description: VALIDATION_ERROR - refresh_token must not be blank
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
        '401':
          description: UNAUTHORIZED - Invalid token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'

  /map/v1/listAllBusinessLocationPicker:
    post:
      tags:
        - map
      summary: List all business location picker

      responses:
        '200':
          description: OK
          content:
            text/html:
              schema:
                $ref: '#/components/schemas/StoreLocationListResult'

  /user/v1/:
    post:
      tags:
        - user
      summary: Get current user data
      security:
        - bearerAuth: []

      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserData'
        '401':
          description: UNAUTHORIZED
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Errors'
                  - $ref: '#/components/schemas/Error'

  /user/v1/update:
    post:
      tags:
        - user
      summary: Update current user data
      security:
        - bearerAuth: []

      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserData' # user_id is required but not checked

      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserData'
        '400':
          description: VALIDATION_ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
        '401':
          description: UNAUTHORIZED
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Errors'
                  - $ref: '#/components/schemas/Error'

  /user/v1/changePassword:
    post:
      tags:
        - user
      summary: Change password
      security:
        - bearerAuth: []

      requestBody:
        $ref: '#/components/requestBodies/ChangePasswordRequest'

      responses:
        '200':
          description: OK
        '400':
          description: VALIDATION_ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
        '401':
          description: UNAUTHORIZED
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Errors'
                  - $ref: '#/components/schemas/Error'
        '403':
          description: PASSWORD_INCORRECT
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
          # PASSWORD_INCORRECT
          # WrongPasswordException

  /user/v1/resetPassword:
    post:
      tags:
        - user
      summary: Reset password

      requestBody:
        $ref: '#/components/requestBodies/ResetPasswordRequest'

      responses:
        '200':
          description: 'OK'
        '400':
          description: VALIDATION_ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'

  /user/v1/resendWelcomeEmail:
    post:
      tags:
        - user
      summary: Resend the Welcome email
      security:
        - bearerAuth: []

      requestBody:
        $ref: '#/components/requestBodies/ResendWelcomeEmailRequest'

      responses:
        '200':
          description: 'OK'
        '400':
          description: VALIDATION_ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
        '401':
          description: UNAUTHORIZED
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Errors'
                  - $ref: '#/components/schemas/Error'
        '403':
          description: FORBIDDEN
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Errors'
        # happens if the given user_id doesn't match with the given bearer token
        # UNAUTHORIZED
        # Access is denied

components:
  # Authentication
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer

  # Describing Requests
  requestBodies:
    LoginByEmailRequest:
      required: true
      content:
        application/json:
          schema:
            type: object
            properties:
              device_type:
                type: string
                description: "Device type"
                enum:  [UNKNOWN, IOS, ANDROID]
              email:
                type: string
                description: "User's email"
              password:
                type: string
                format: password
                description: "User's password"
            example:
              device_type: "ANDROID"
              email: "john.doe@dev.local"
              password: "p@ssw0rd"
            required:
              - device_type
              - email
              - password

    ChangePasswordRequest:
      required: true
      content:
        application/json:
          schema:
            type: object
            properties:
              old_password:
                type: string
                description: "Old password"
              new_password:
                type: string
                description: "New password"
              refresh_token:
                type: string
                description: "Refresh token"
            required:
              - old_password
              - new_password
              - refresh_token

    ResetPasswordRequest:
      required: true
      content:
        application/json:
          schema:
            type: object
            properties:
              email:
                type: string
                format: email
                example: john.doe@dev.local
            required:
              - email

    ResendWelcomeEmailRequest:
      required: true
      content:
        application/json:
          schema:
            type: object
            properties:
              user_id:
                type: string
                example: "123456"
            required:
                - user_id

    UnlockHiddenStoreRequest:
      required: true
      content:
        application/json:
          schema:
            type: object
            properties:
              unlock_code:
                type: string
              user_id:
                type: string
                example: "123456"
            required:
              - unlock_code
              - user_id

 # Describing Responses
  schemas:
    Errors:
      type: object
      properties:
        errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                description: Error type
              message:
                type: string
                description: Error message
            required:
              - code
      required:
        - errors

    Error:
      type: object
      properties:
        timestamp:
          type: integer
          example: 1622583457179
        status:
          type: integer
          example: 401
        error:
          type: string
          example: "Unauthorized"
        message:
          type: string
        path:
          type: string
          example: "/api/auth/v2/logout"
      required:
        - timestamp
        - status
        - error
        - message
        - path

    StoreLocationListResult:
      type: object
      properties:
        info:
          type: array
          items:
            type: object
            properties:
              latitude:
                type: string
                example: "23.45678912"
              longitude:
                type: string
                example: "5.67890123"
        msg:
          type: string
          example: "OK"
        status_code:
          type: string
          example: "1"
      required:
        - info
        - msg
        - status_code

    RefreshTokenResult:
      type: object
      properties:
        access_token:
          type: string
        refresh_token:
          type: string
      required:
        - access_token
        - refresh_token

    AppSettings:
      type: object
      properties:
        on_app_open_message:
          type: string
          enum: [BLOCKING]
        open_message_type:
          type: string
          enum: [BLOCKING]
        open_message_url:
          type: string
          format: uri
          example: 'https://space.toogoodtogo.com/app-update/android'
        countries:
          type: array
          items:
            type: object
            properties:
              country_iso_code:
                type: string
                minLength: 2
                maxLength: 2
                example: 'FR'
              terms_url:
                type: string
                format: uri
                example: 'https://toogoodtogo.fr/fr/terms-and-conditions'
              privacy_url:
                type: string
                format: uri
                example: 'https://toogoodtogo.fr/fr/privacy-policy'
            required:
              - country_iso_code
              - terms_url
              - privacy_url
          minItems: 1
        purchase_rating_start:
          type: string
          pattern: '^\d{2}:\d{2}:\d{2}$'
          example: '06:00:00'
        purchase_rating_end:
          type: string
          pattern: '^\d{2}:\d{2}:\d{2}$'
          example: '23:00:00'
        purchase_rating_delay:
          type: number
          format: double
          example: "5400.000000000"
      required:
        - countries
        - purchase_rating_start
        - purchase_rating_end
        - purchase_rating_delay

    UserSettings:
      type: object
      properties:
        country_iso_code:
          type: string
          minLength: 2
          maxLength: 2
          example: 'FR'
        phone_country_code_suggestion:
          type: string
          example: '33'
        is_user_email_verified:
          type: boolean
        terms_url:
          type: string
          format: uri
          example: 'https://toogoodtogo.fr/fr/terms-and-conditions'
        privacy_url:
          type: string
          format: uri
          example: 'https://toogoodtogo.fr/fr/privacy-policy'
        contact_form_url:
          type: string
          format: uri
          example: 'https://toogoodtogo.fr/fr/support/consumer'
        blog_url:
          type: string
          format: uri
          example: 'https://toogoodtogo.fr/fr/blog'
        careers_url:
          type: string
          format: uri
          example: 'https://toogoodtogo.org/en/careers'
        education_url:
          type: string
          format: uri
          example: 'https://toogoodtogo.fr/fr/movement/education'
        instagram_url:
          type: string
          format: uri
          example: 'https://www.instagram.com/toogoodtogo.fr'
        store_signup_url:
          type: string
          format: uri
          example: 'https://toogoodtogo.fr/fr/business?webview=1&utm_medium=App&utm_source=App&utm_campaign='
        store_contact_url:
          type: string
          format: uri
          example: 'https://toogoodtogo.fr/fr/support/store'
        bound_sw:
          type: object
          properties:
            longitude:
              type: number
              format: float
              example: -1.2345678
            latitude:
              type: number
              format: float
              example: 23.45678912
        bound_ne:
          type: object
          properties:
            longitude:
              type: number
              format: float
              example: 5.67890123
            latitude:
              type: number
              format: float
              example: 45.678901
        meals_saved:
          type: object
          properties:
            country_iso_code:
              type: string
              minLength: 2
              maxLength: 2
              example: 'FR'
            share_url:
              type: string
              format: uri
              example: 'https://share.toogoodtogo.com/mealssaved/b4f64a9e4482f4e7ef449c66e51adc98?locale=fr_FR'
            image_url:
              type: string
              format: uri
              example: 'https://store.toogoodtogo.com/web/resource/v2/sharing/mealsSaved/mobile/4/fr_FR/b4f64a9e4482f4e7ef449c66e51adc98'
            meals_saved_last_month:
              type: integer
              example: 915314
            month:
              type: integer
              example: 4
            year:
              type: integer
              example: 2021
        bank_transaction_fee:
          type: string
        my_store_url:
          type: string
        order_id:
          type: string
        unrated_order_id:
          type: string
        panic_message:
          type: string

        has_any_vouchers:
          type: boolean
        can_show_best_before_explainer:
          type: boolean

    UserData:
      type: object
      properties:
        user_id:
          type: string
          example: "123456"
        name:
          type: string
          example: "John Doe"
        country_id:
          type: string
          minLength: 2
          maxLength: 2
          example: 'FR'
        email:
          type: string
          format: email
          example: 'john.doe@dev.local'
        phone_country_code:
          type: string
          example: '33'
        phone_number:
          type: string
          example: '612345678'
        role: # Not used in the mobile app
          type: string
          enum: [CONSUMER]
        is_partner:
          type: boolean
        newsletter_opt_in:
          type: boolean
        push_notifications_opt_in:
          type: boolean
      required:
        - user_id
        - name
        - phone_country_code
        - phone_number
        - newsletter_opt_in
        - push_notifications_opt_in

    Order:
      type: object
      properties:
        cancel_until:
          type: string
        confirmation_email_sent_to:
          type: string
        food_handling_instructions:
          type: string
        buffet_instructions:
          type: string
        can_user_supply_packaging:
          type: boolean
        packaging_option:
          type: string
        is_rated:
          type: boolean
        item_collection_info:
          type: string
        item_cover_image:
          type: string
        item_id:
          type: integer
        item_logo:
          type: string
        item_name:
          type: string
        pickup_interval:
          type: object
          properties:
            start:
              type: string
            end:
              type: string
        pickup_location:
          type: string
        price:
          type: string
        price_excluding_taxes:
          type: string
        price_including_taxes:
          type: string
        sales_taxes:
          type: string
        total_applied_taxes:
          type: string
        quantity:
          type: integer
        overall_rating:
          type: string
        order_id:
          type: integer
        redeem_interval:
          type: string
        order_state:
          type: string
          enum: [ACTIVE, REDEEMED, REFUNDED_OR_CANCELLED, UNREDEEMED, NOT_COLLECTED]
        store_branch:
          type: string
        store_id:
          type: integer
        store_logo:
          type: string
        store_name:
          type: string
        time_of_purchase:
          type: string
          format: date-time
        would_buy_again:
          type: boolean
        is_buffet:
          type: boolean
        can_show_best_before_explainer:
          type: boolean
        needsSync:
          type: boolean
        hasCollectionTimeChanged:
          type: boolean
        hasCollectionStateChanged:
          type: boolean

    ListOrders:
      type: object
      properties:
        current_time:
          type: string
          format: date-time
          example: "2021-06-01T00:24:58.768422Z"
        has_more:
          type: boolean
        orders:
          type: array
          items:
            $ref: '#/components/schemas/Order'
      required:
        - current_time
        - has_more
        - orders

    Voucher:
      type: object
      properties:
        id:
          type: string
          example: '1234'
        name:
          type: string
        state:
          type: string
          enum: [PENDING, ACTIVE, USED, EXPIRED]
      required:
        - id
        - name
        - state

    ListUserVoucher:
      type: object
      properties:
        vouchers:
          type: array
          items:
            $ref: '#/components/schemas/Voucher'

    StartupResponse:
      type: object
      properties:
        user:
          $ref: '#/components/schemas/UserData'
        app_settings:
          $ref: '#/components/schemas/AppSettings'
        user_settings:
          $ref: '#/components/schemas/UserSettings'
        orders:
          $ref: '#/components/schemas/ListOrders'
        vouchers:
          $ref: '#/components/schemas/ListUserVoucher'

    LoginResponse:
      type: object
      properties:
        access_token:
          type: string
        refresh_token:
          type: string
        startup_data:
          $ref: '#/components/schemas/StartupResponse'
        user_count:
          type: string
      required:
        - access_token
        - refresh_token
        - startup_data

    UnlockHiddenStoreResponse:
      type: object
      properties:
        state:
          type: string
          enum:  [OK, CODE_INVALID, ALREADY_UNLOCKED]
      required:
        - state