marchon/master-zapier-plan-draft
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
master-zapier-plan-draft/docs/01-product/api-gap-analysis.md
George Lambert b4150c8250 Milestone 0: import zappier billing, Verae middleware, and Zapier research 
Compose-ready workspace: packages/zappier (rate card, portal, Stripe),
packages/verae-zapier-middleware (timestamp + NATS), packages/verae-zapier
(CLI app), vendor/zapier-platform, and research/zapier vendor corpus.

Gate 0 structure checks pass. Product code and research are not yet wired.
2026-09-09 02:37:36 -04:00

1.7 KiB
Raw Permalink Blame History

API gap analysis

Live spec snapshot: veraetime-openapi.yaml
Swagger UI: https://api.veraetime.net/docs/swagger/index.html

What Verae actually exposes

Auth: POST /auth/login → JWT. All API routes Authorization: Bearer <jwt>.

Operation Path Notes
createTimestamp POST /api/timestamp Body { data, hashAlg? }, 202 { jobId }
createBatchTimestamp POST /api/batch/timestamp { items: [...] }
verifyTimestamp POST /api/verify { certificate } → { valid, timestamp, blockIndex }
verifyBatchTimestamp POST /api/batch/verify
getJobStatus GET /api/status/{jobId} pending / completed / failed
getJobVerification GET /api/verify/{jobId}
getBatchJobStatus POST /api/batch/status
Admin /admin/* dashboard, metrics, blockchain, queue, timestamps, hash
Users /auth/users admin CRUD

Gaps vs README a–m

  • No customer API-key issuance (a) — zappier owns this.
  • No billing, invoices, payment methods, subscriptions (b, j–m) — zappier owns this.
  • No lookup-by-SHA256 or idempotent “return original timestamp” (c, d).
  • No public/private metadata (e, h).
  • No encrypted object storage or sharing (f, g).
  • No certified retrieval receipt / extra seal (i).
  • Timestamp input is data + hashAlg, not a first-class SHA256 key.

Adapter rule

The middleware may expose a richer Zapier-facing contract (hash index, metadata, receipts) implemented by MOCK_VERAE / mock stores.

The live client (packages/verae-zapier-middleware/src/clients/veraeClient.js) must only call paths in the snapshot OpenAPI. Unknown fields must not be sent to https://api.veraetime.net.