# FlowFabric Postman collection

`FlowFabric.postman_collection.json` — generated from the live OpenAPI schema
(Postman's own `openapi-to-postmanv2` converter), then hand-tuned so a full
top-to-bottom run succeeds end-to-end against a real tenant. See the
collection's own description (visible in Postman after import) for the full
run-order notes and the short list of expected non-2xx results.

## Import and run

1. Import `FlowFabric.postman_collection.json` into Postman.
2. Make sure the backend is running (`uvicorn app.main:app`, see `../README.md`)
   and reachable at the collection's `baseUrl` variable (defaults to
   `http://127.0.0.1:8000`).
3. The collection ships pre-filled with a tenant provisioned via
   `../scripts/provision_tenant.py` (`tenant_id`, `user_id`, `admin_role_id`
   collection variables). To use your own tenant instead, provision one and
   overwrite those three variables.
4. Run it via the Collection Runner, or open each folder and click through
   requests top-to-bottom — order matters, since most `Create X` requests
   capture the new id into a collection variable (via a `test` script) that
   later requests in the same run depend on.

## Regenerating after an API change

The collection is generated, not hand-written — after changing a router,
regenerate rather than hand-editing the JSON:

```bash
cd backend/postman
npm install                          # once — installs openapi-to-postmanv2
curl -s http://127.0.0.1:8000/openapi.json -o openapi.json   # backend must be running
npm run build                        # convert.js, then postprocess.js
```

`postprocess.js` is where the actual tuning lives: it wires the
`X-Tenant-Id`/`X-User-Id`/`X-Vendor-Id` headers to collection variables,
adds the id-capture test scripts, fixes a handful of example bodies the
generator can't get right on its own (cross-field validation, FK-typed
optional fields, bare-array bodies), and reorders folder contents so a
resource's `Delete` request runs after its sub-endpoints instead of before.
Read the comments there before changing endpoint shapes that those fixes
depend on (e.g. renaming a `Create X` response's id field, or a path
parameter name). It also hardcodes the shipped `tenant_id`/`user_id`/
`admin_role_id` at the bottom — replace those with a freshly provisioned
tenant's ids (`../scripts/provision_tenant.py`) each time you rebuild.