openapi: 3.0.3
info:
  title: TenantPilot Admin Context APIs (Spec 080)
  version: 0.1.0
  description: |
    Minimal HTTP contract for non-Filament endpoints involved in workspace/tenant context selection.

    Filament page/resource routes are not fully described here because they are generated by Filament.
    The spec’s primary contract for those is the route map in `routes.md`.

paths:
  /admin/switch-workspace:
    post:
      summary: Switch the active workspace context
      responses:
        '204': { description: Workspace switched }
        '302': { description: Redirect (if implemented) }
        '401': { description: Unauthenticated }
        '404': { description: Not a workspace member (deny-as-not-found) }

  /admin/select-tenant:
    post:
      summary: Select the active tenant context within the selected workspace
      responses:
        '204': { description: Tenant selected }
        '302': { description: Redirect (if implemented) }
        '401': { description: Unauthenticated }
        '404': { description: Not entitled to tenant (deny-as-not-found) }

  /admin/clear-tenant-context:
    post:
      summary: Clear the active tenant context
      responses:
        '204': { description: Tenant context cleared }
        '302': { description: Redirect (if implemented) }
        '401': { description: Unauthenticated }

components:
  securitySchemes:
    SessionAuth:
      type: apiKey
      in: cookie
      name: tenantpilot_session
security:
  - SessionAuth: []