Vendor API v0.6.5

The other three APIs describe what you can GET from the library system. This one describes what the system can SEND to you — which is why you implement it rather than call it.

Two things use it. The library system sends events when something has happened, so your product does not have to keep asking; and it calls a callback when a patron has signed in at the library and needs to be returned to your product as authenticated.

How to integrate

1. Expose the endpoint. POST /events/receiver has to accept and answer. The address is yours; it is agreed with the provider, exactly as the Provider API’s base URL is agreed the other way round.
2. Verify the sender. The call carries a shared secret in the X-OLA-SECRET header (EventReceiverSecretAuth in the specification). If it does not match, answer 401 — it is the only thing separating the library system from anyone else who can reach your address.
3. Accept the version. version is sent as a query parameter on two of the three operations. If you do not support it, answer with error code 600 — the same contract as the other direction, with you as the recipient.

How it relates to the other APIs

The Vendor Consumer API is an entry point alongside the Provider API, not a subset of it: only GET /version exists in both. The two are the directions of the same collaboration, and a product that both reads and receives implements this one and calls Provider.