openapi: 3.0.3
info:
  title: Mobile Check Cashing SDK — Add Session Attributes
  version: '1'
  description: >
    Ancillary method for attaching session-scoped attributes to a

    customer-bound session (bound via `/authenticate-obo` for Card partners,

    or `/paypal/customers/register` for PayPal partners). Common uses include
    passing the

    `SsoToken`, setting a preferred email, and filtering which cards

    are visible in the SDK via `AccountIdFilter` or

    `AccountNumberFilter` (mutually exclusive).


    Session attributes are **temporary** — they live only for the

    duration of the SDK session and are reset on the next call. To

    change customer information permanently, the customer must contact

    Ingo Money Customer Service.


    Requires the customer's `ssoToken` — from `/authenticate-obo` (Card

    partners) or `/paypal/customers/register` (PayPal partners) — supplied

    as the first object in `sessionAttributes`, with the `SessionId` header

    from `POST /api/v1/partners/authenticate`.
servers:
  - url: https://check-cashing-uat.spykemobile.net
    description: UAT (Sandbox)
  - url: https://check-cashing.spykemobile.net
    description: Production
security:
  - OAuth2:
      - sdkapi
tags:
  - name: Session Attributes
    description: Temporary, session-scoped configuration for the SDK.
paths:
  /api/v1/partners/add-session-attributes:
    post:
      tags:
        - Session Attributes
      operationId: addSessionAttributes
      summary: Attach session-scoped attributes
      description: |
        Attach session attributes to the current OBO-bound session.
        Most commonly used to pass the `SsoToken` returned from
        `/authenticate-obo` and to optionally filter the cards
        visible to the user during this session.
      parameters:
        - $ref: '#/components/parameters/SessionIdHeader'
        - $ref: '#/components/parameters/DeviceIdHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddSessionAttributesRequest'
            example:
              sessionAttributes:
                - name: SsoToken
                  value: ABC123
                - name: PreferredEmail
                  value: customer@domain.com
                - name: AccountIdFilter
                  value: 12345,43412,67894
      responses:
        '200':
          description: Attributes accepted. Empty response body.
        '422':
          description: |
            Invalid attribute value — e.g., a malformed email or both
            `AccountIdFilter` and `AccountNumberFilter` supplied
            (mutually exclusive).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: https://tools.ietf.org/html/rfc4918#section-11.2
                title: Invalid Information
                status: 422
                detail: >-
                  Oops, there was a problem with your request. The following
                  field(s) are invalid : PreferredEmail. Please check the values
                  on the screen and try again.
                instance: /api/v1/partners/add-session-attributes
                errorCode: INVALID_INFORMATION
components:
  securitySchemes:
    OAuth2:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://auth.spykemobile.net/connect/token
          scopes:
            sdkapi: Mobile Check Cashing SDK partner methods
  parameters:
    SessionIdHeader:
      name: SessionId
      in: header
      required: true
      schema:
        type: string
    DeviceIdHeader:
      name: DeviceId
      in: header
      required: true
      schema:
        type: string
  schemas:
    AddSessionAttributesRequest:
      type: object
      required:
        - sessionAttributes
      properties:
        sessionAttributes:
          type: array
          minItems: 1
          items:
            $ref: '#/components/schemas/SessionAttribute'
    SessionAttribute:
      type: object
      required:
        - name
        - value
      description: >
        Recognized session attribute names:


        | Name | Required | Description |

        |---|---|---|

        | `SsoToken` | Required | SSO token returned from `/authenticate-obo` |

        | `PreferredEmail` | Optional | Email for customer communication |

        | `AccountIdFilter` | Optional* | Comma-separated Ingo card GUIDs to
        show in the SDK |

        | `AccountNumberFilter` | Optional* | Comma-separated raw card numbers
        (or card tokens) to show in the SDK |


        *`AccountIdFilter` and `AccountNumberFilter` are mutually

        exclusive — supplying both yields a 422 error.
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 100
        value:
          type: string
          minLength: 1
          maxLength: 300
    ProblemDetails:
      type: object
      required:
        - type
        - title
        - status
      properties:
        type:
          type: string
          format: uri
        title:
          type: string
        status:
          type: integer
        detail:
          type: string
        instance:
          type: string
        errorCode:
          type: string