From 3f7288197757da7de75e3c474d3cd2c9f0ed8a17 Mon Sep 17 00:00:00 2001
From: "Aaron K. Clark" <akclark@thenetwerk.net>
Date: Tue, 19 May 2026 07:52:25 -0500
Subject: [PATCH] docs(openapi): declare Idempotency-Replay on POST
 /v1/inventoryitem 201
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Continuation of the single-create POST sweep (tracking #245). The
Idempotency-Key middleware already applies to /v1/inventoryitem POSTs,
but the response-header declaration was missing from the 201 — so
SDK generators couldn't surface the replay flag for non-bulk
inventoryitem creates. Adds `headers: idempotencyReplayResponseHeader`
to the 201 response, matching the pattern previously applied to
customer/timeentry/worker/billingtype POSTs.

No behavior change — pure spec metadata. All 688 tests still pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 app/config/openapi.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/app/config/openapi.js b/app/config/openapi.js
index 7bdcbb3..2530cb2 100644
--- a/app/config/openapi.js
+++ b/app/config/openapi.js
@@ -820,7 +820,14 @@ const spec = {
                 security: [{ authKey: [] }],
                 parameters: [idempotencyKeyHeader],
                 requestBody: { required: true, content: { 'application/json': { schema: { $ref: '#/components/schemas/InventoryItem' } } } },
-                responses: { 201: { description: 'Created' }, 400: { description: 'Bad request' }, 403: { description: 'Auth failure' } },
+                responses: {
+                    201: {
+                        description: 'Created',
+                        headers: idempotencyReplayResponseHeader,
+                    },
+                    400: { description: 'Bad request' },
+                    403: { description: 'Auth failure' },
+                },
             },
         },
         '/v1/inventoryitem/{id}': {