docs(api) | add Partner API Explorer and documentation SPW-20190

[amir-faghihi]

Functional Changes

Local QA sign-off

Not applicable by Amir. This is a documentation and docs UI change.

What is the change?

• Add public Partner API documentation for customer attribution, order management links, users, webhooks, credentials, and request signing.
• Add Partner API examples and navigation aligned with the documented endpoint surface.
• Add API Explorer support for public, private organizer, and partner API pages, including method selection, path variables, request bodies, credential guidance, persisted session inputs, and styled JSON responses.
• Update API reference mappings, navigation, redirects, SEO metadata, and supporting CLI, webhook, tracking, and Meta wording.

Why the change is important?

• Gives Partner developers a complete server-to-server integration path from onboarding through authenticated requests and webhooks.
• Lets developers validate requests from the docs while keeping credentials in browser session storage and warning users about production-changing requests.
• Keeps documentation navigation and legacy URLs consistent.

How to test?

• npm run build
• npm run test:links
• Open the Public API, Private Organizer API, and Partner API pages.
• Verify Outline, Examples, and Explorer tabs, endpoint-specific paths, supported HTTP methods, request bodies, path variables, credential warnings, and formatted JSON responses.
• Jira: SPW-20190

Database Migrations

No database migrations.

Additional Notes

• Explorer credentials are stored only in browser session storage for the current browser session. Use test credentials only and never expose Partner secrets in client-side code.
• Repository-wide lint still reports unrelated pre-existing issues outside this change; targeted lint for the changed Explorer, page-tools, and API mapping files passed.

[dawoodali-showpass]

This status description is too ambiguous for an integration client: invalid venue is grouped into 409 or 403 according to the failure boundary. Can we document the exact contract, with validation errors as 400, authentication or scope denial as 403, and 409 reserved for actual identity or resource conflicts?

[amir-faghihi]

Fixed.

[dawoodali-showpass]

The endpoint catalog stops at POST /api/partner/orders/manage-link/, but the returned URL points to GET /account/partner-login/<code>/. That browser consume route is part of the integration contract and controls one-time use, expiry, order-scoped session, and redirect behavior. Can we document it alongside the POST endpoint and state the expired or replayed-link behavior?