{
  "openapi": "3.1.0",
  "info": {
    "title": "Oxford Systems UK private service enquiries",
    "version": "1.0.0",
    "description": "Submit a question for human review. No automated booking or availability confirmation. POST ask needs name, email, service_id, question and privacy_acknowledged=true. The 201 response supplies a private access_token and fragment reply_url. Keep both confidential. POST read and followup need conversation_id and Authorization: Bearer access_token. Only approved answers are returned. Links expire after 14 days. No callback URLs or external URLs are fetched. A human contact may be required; this is not real-time chat. Customer actions never authorise publication of a draft. Do not send secrets or confidential technical evidence. Requests may be rate limited; respect Retry-After. Submission and follow-up are limited to one request per minute per client."
  },
  "servers": [
    {
      "url": "https://oxfordsystems.co.uk"
    }
  ],
  "paths": {
    "/agent-qa.php": {
      "post": {
        "operationId": "privateServiceEnquiry",
        "summary": "Submit, read or follow up a private service question",
        "security": [
          {},
          {
            "replyAccess": []
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "action"
                ],
                "properties": {
                  "action": {
                    "type": "string",
                    "enum": [
                      "ask",
                      "read",
                      "followup"
                    ]
                  },
                  "name": {
                    "type": "string",
                    "maxLength": 150
                  },
                  "email": {
                    "type": "string",
                    "format": "email",
                    "maxLength": 254
                  },
                  "service_id": {
                    "type": "string",
                    "description": "An exact id from https://oxfordsystems.co.uk/service-catalogue.json."
                  },
                  "question": {
                    "type": "string",
                    "maxLength": 4000
                  },
                  "privacy_acknowledged": {
                    "type": "boolean",
                    "description": "Required true for ask; submit only with the represented person\u2019s authorisation."
                  },
                  "conversation_id": {
                    "type": "string",
                    "pattern": "^[a-f0-9]{32}$"
                  }
                },
                "additionalProperties": false
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Conversation with approved answers only"
          },
          "201": {
            "description": "Question accepted; retain the private capability returned for a new conversation"
          },
          "400": {
            "description": "Invalid JSON or action"
          },
          "403": {
            "description": "Origin rejected"
          },
          "404": {
            "description": "Conversation unavailable or access token invalid"
          },
          "409": {
            "description": "Await review before following up"
          },
          "410": {
            "description": "Private access expired"
          },
          "413": {
            "description": "Request too long"
          },
          "422": {
            "description": "Validation failed"
          },
          "429": {
            "description": "Rate limited; observe Retry-After"
          },
          "503": {
            "description": "Pilot not enabled or storage unavailable"
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "replyAccess": {
        "type": "http",
        "scheme": "bearer",
        "description": "The private read token returned by ask. Never place it in a query string or log it."
      }
    }
  }
}