# AI agents — itjeom Partner API (live v0.2)

When the user asks to **build a site / shop / board using itjeom APIs**, treat this folder as the contract.

## Auth (live)

1. Hub member logs in at `https://developers.itjeom.com` (or `https://itjeom.com`).
2. Apply for an API app at `/console` → operator approves → **client_id** / **client_secret** (server-side only).
3. `POST https://api.itjeom.com/partner/v1/oauth/token` with `client_credentials` or `refresh_token`.
4. Call Partner API with `Authorization: Bearer {access_token}`.

Never put `client_secret` in browser JS, mobile apps, or git.

## Base URLs

| Role | URL |
|------|-----|
| Docs | `https://developers.itjeom.com` |
| Partner API | `https://api.itjeom.com/partner/v1` |
| Internal central / admin | `https://api.itjeom.com` — **not for third-party agents** |

## Spec

- OpenAPI: [`openapi/partner-v1.yaml`](openapi/partner-v1.yaml) — version **0.2.0 live**
- Recipes: [`content/recipes/`](content/recipes/) → 공개 URL `/recipes/{slug}`
- Examples: [`examples/`](examples/)

## Scopes

| Scope | Use |
|-------|-----|
| `shop:read` | Product list/get |
| `board:read` | Board post list/get |
| `shop:order:write` | Create orders |

## Build order (shop MVP)

1. Token — `POST /partner/v1/oauth/token`
2. List products — `GET /partner/v1/shop/products`
3. Product detail — `GET /partner/v1/shop/products/{uniq}`
4. Create order — `POST /partner/v1/shop/orders` (when scope allows)

## Hard rules

- **Do not** call internal `/shop/*`, storefront `/egb_api/*`, or **admin JWT** / `site_hash` / operator session flows from third-party apps.
- **Do not** invent field names — use OpenAPI schemas (`Product`, `Post`, `TokenResponse`).
- **Do not** put secrets in repo or client bundles.
- Tenant PII (email/password) uses hybrid member store — Partner API does not expose raw PII; use documented DTOs only.
- Token endpoint: JSON or `application/x-www-form-urlencoded`; optional Basic auth. No OAuth authorize redirect.

## Health check

`GET /partner/v1/meta/health` — no auth required.
