# Vendor API v0.6.5

3 groups · 3 operations · 3 paths · 152 schemas
Source: https://plas.redia.dk/en/vendor/v0.6.5/

The other direction. Where the Provider API is what the library system exposes, this is what the library product exposes back.

Generated from `vendor_v0_6_5.yaml` · OpenAPI 3.0.0

- **Implemented by:** The library product — the vendor's own service
- **Called by:** The library system, when something has happened or needs completing

The other three APIs describe what you can GET from the library system. This one
describes what the system can SEND to you — which is why you implement it rather
than call it.

Two things use it. The library system sends **events** when something has
happened, so your product does not have to keep asking; and it calls a
**callback** when a patron has signed in at the library and needs to be returned
to your product as authenticated.

## How to integrate

1. **Expose the endpoint.** `POST /events/receiver` has to accept and answer.
   The address is yours; it is agreed with the provider, exactly as the Provider
   API's base URL is agreed the other way round.
2. **Verify the sender.** The call carries a shared secret in the `X-OLA-SECRET`
   header (`EventReceiverSecretAuth` in the specification). If it does not
   match, answer `401` — it is the only thing separating the library system from
   anyone else who can reach your address.
3. **Accept the version.** `version` is sent as a query parameter on two of the
   three operations. If you do not support it, answer with error code `600` —
   the same contract as the other direction, with you as the recipient.

## How it relates to the other APIs

The Vendor Consumer API is an **entry point** alongside the Provider API, not a
subset of it: only `GET /version` exists in both. The two are the directions of
the same collaboration, and a product that both reads and receives implements
this one and calls Provider.

## Shared across operations

These definitions are referenced by many operations. They are documented once here; an operation lists only what is specific to it, plus the codes it can return.

### Authentication

- `EventReceiverSecretAuth` · `apiKey`

### Parameters

- `version` (In `query`, [`Version`](https://plas.redia.dk/en/vendor/v0.6.5/schemas/#Version), optional, used by 2 of 3) — The version of Open Library the vendor expects to receive, if this version isn't supported by the provider an error code 600 (Unsupported Open Library API version) is returned.

### Error responses

- `HttpCode400` ([`Errors`](https://plas.redia.dk/en/vendor/v0.6.5/schemas/#Errors), used by 1 of 3) — The list of errors.
- `HttpCode401Secret` (`No response body.`, used by 1 of 3) — Secret is invalid.

## All groups

- [Callback](https://plas.redia.dk/en/vendor/v0.6.5/callback/) — 1 operation
- [Event](https://plas.redia.dk/en/vendor/v0.6.5/event/) — 1 operation
- [Version](https://plas.redia.dk/en/vendor/v0.6.5/version/) — 1 operation
- [Schema index](https://plas.redia.dk/en/vendor/v0.6.5/schemas/) — 152 schemas