From 6f62f66105af0bae63c09c297a48e6ee60b9cdf3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Sat, 22 Aug 2026 13:18:25 +0200
Subject: [PATCH] Describe the WHOOP disconnect in the contract
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The eighth teardown endpoint, missed when the seven siblings were split across
the earlier batches. It has no per-user unsubscribe to make — WHOOP webhook
subscriptions are registered once per developer app rather than per category
the way Withings does it — and it leaves the BYO-key credentials in place so a
reconnect does not force a re-paste.

Like every other `POST /api/<provider>/disconnect`, a repeat call answers 404
rather than an idempotent 200, and the description says so. That completes the
tally: all seven disconnect endpoints refuse a repeat, all six credential
DELETEs accept one.
---
 src/lib/openapi/routes/integrations.ts | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/src/lib/openapi/routes/integrations.ts b/src/lib/openapi/routes/integrations.ts
index f30216231..1a711c1b2 100644
--- a/src/lib/openapi/routes/integrations.ts
+++ b/src/lib/openapi/routes/integrations.ts
@@ -1286,6 +1286,30 @@ export const integrationPaths: NonNullable<ZodOpenApiObject["paths"]> = {
       },
     },
   },
+  "/api/whoop/disconnect": {
+    post: {
+      tags: ["Integrations"],
+      summary: "Disconnect the caller's WHOOP account",
+      description:
+        "Deletes the connection row, audits the teardown and parks the `whoop` ledger at `disconnected`. There is no per-user unsubscribe to make — WHOOP webhook subscriptions are registered once per developer app, unlike Withings which subscribes per category. The BYO-key credentials are deliberately LEFT IN PLACE so a reconnect does not force the user to re-paste them; use the credentials DELETE to remove those too. No body. Auth via cookie or Bearer.",
+      responses: {
+        "200": {
+          description: "The connection was removed.",
+          content: {
+            "application/json": {
+              schema: dataEnvelope(disconnectedAck, "WhoopDisconnectEnvelope"),
+            },
+          },
+        },
+        "404": {
+          description:
+            "No WHOOP connection to remove. NOT an idempotent no-op: a second disconnect answers 404 rather than 200.",
+          content: { "application/json": { schema: errorEnvelope } },
+        },
+        ...stdResponses,
+      },
+    },
+  },
   "/api/withings/status": {
     get: {
       tags: ["Integrations"],