Integration & API

• F14.01.01 Shipped

  RESTful API with OpenAPI/Swagger documentation — GET /api/info discovery endpoint, enriched OpenAPI metadata (contact, license, terms, tags), Swagger UI at /docs, ReDoc at /redoc

  ✅ PL-F1401a
• F14.01.02 Shipped

  API versioning — X-API-Version response header on all responses, /v1/ URL prefix transparency, X-API-Version-Deprecated header for mismatched versions

  ✅ PL-F1401a
• F14.01.03 Shipped

  Rate limiting per client — X-RateLimit-Limit/X-RateLimit-Remaining/X-RateLimit-Reset response headers, per-IP sliding window, per-M2M-client configurable limits (1–10 000 req/min), abuse monitor with lockout

  ✅ PL-F1401a
• F14.01.04 Shipped

  M2M OAuth2 client credentials authentication — RFC 6749 §4.4 compliant POST /auth/m2m/token, ES512 JWT, SHA-256 secret hashing, IP CIDR allowlist, secret rotation, admin CRUD

  ✅ PL-F1401a
• F14.01.05 Shipped

  Public endpoints (rankings, results, calendar, venue directory) — GET /public/rankings, /public/rankings/{id}, /public/results, /public/results/{competition_id}, /public/venues, /public/venues/{id} with cursor pagination, filters, and search

  ✅ PL-F1401b
• F14.01.06 Shipped

  API developer portal — POST /api-tokens, scopade M2M-tokens, rate limiting

  ✅ PL-F1401b
• F14.01.07 Shipped

  API key management — token-livscykel (create, revoke, validate), SHA-256-hash

  ✅ PL-F1401b
• F14.01.08 Shipped

  API usage analytics and monitoring — ApiUsageRecord hourly buckets, GET /api-usage/summary, /api-usage/by-token, /api-usage/timeseries with per-endpoint breakdowns, latency tracking, and rate-limit hit counting

  ✅ PL-F1401b
• F14.01.09 Shipped

  ERD drill-down explorer — three-tier /erd viewer (super-domain → sub-domain → entity) with breadcrumb, URL-state, fuzzy search, heatmap, BFS radius 1–2, cross-domain-bridge toggle; new JSON endpoints /erd/domains, /erd/domains/{id}, /erd/entities/{name}; project-configurable F01–F20 mapping via SuperDomainConfig

  ✅ PL-T097
• F14.01.10 Shipped

  Service-account M2M-tokens with admin scopes — ServiceAccount-modell, ApiScope admin-scopes (tenants:write, federations:write, cms:write, admin_invitations:create, users:write, seed:run), /sys/service-accounts CRUD + token mint/revoke, 90-day default TTL, agent-driven prod-bootstrap utan WebAuthn-step-up

  ✅ PL-T293

• F14.02.01 Shipped

  Data exchange with existing national federation systems — FederationIntegrationConfig CRUD, lifecycle (draft→active→paused→decommissioned), field mapping, sync state

  ✅ PL-F1402a
• F14.02.02 Shipped

  File import service (CSV, XML, fixed-width) for legacy data — FileFormatDefinition CRUD, POST /parse endpoint, fixed-width column parser

  ✅ PL-F1402a
• F14.02.03 Shipped

  FIPJP data submission format support — FipjpSubmission CRUD, canonical envelope, payload validation per type, lifecycle (draft→submitted→accepted/rejected)

  ✅ PL-F1402a
• F14.02.04 Shipped

  Continental confederation data exchange — ContinentalExchangeSession CRUD, lifecycle (initiated→in_progress→completed/failed/cancelled), participant tracking

  ✅ PL-F1402a
• F14.02.05 Shipped

  Bi-directional sync for federations with existing systems — BidirectionalSyncSession CRUD, lifecycle (pending→pulling→pushing→completed/resolving_conflicts), conflict detection/resolution, per-direction statistics

  ✅ PL-F1402b
• F14.02.06 Shipped

  Migration tools for legacy system data import — MigrationJob CRUD, lifecycle (draft→validating→validated→running→completed), batch processing, dry-run, rollback

  ✅ PL-F1402b
• F14.02.07 Shipped

  Import validation and error reporting — ImportValidationReport CRUD, rule engine (required/type/format/range/uniqueness), summary statistics, error filtering

  ✅ PL-F1402b

• F14.03.01 Shipped

  Webhook configuration (outbound) — POST /webhooks med prenumerationshantering

  ✅ PL-F1403
• F14.03.02 Shipped

  Event types — competition.created/completed, result.published, license.issued/transferred, ranking.updated, sanction.created

  ✅ PL-F1403
• F14.03.03 Shipped

  Webhook retry med exponential backoff (max 5 försök, 10s×n²)

  ✅ PL-F1403
• F14.03.04 Shipped

  HMAC SHA-256-signering med delad hemlighet, secret rotation

  ✅ PL-F1403
• F14.03.05 Shipped

  Petanque-specifik händelsekatalog (7 event-typer)

  ✅ PL-F1403
• F14.03.06 Shipped

  Webhook delivery log — per-prenumeration, manuell retry, test-endpoint

  ✅ PL-F1403

• F14.04.01 Shipped

  Payment gateway integration (Stripe, PayPal, Swish, iDEAL, etc.) — PaymentGatewayIntegration CRUD, lifecycle (draft→active→paused→decommissioned), key-vault credential refs, multi-currency, sandbox mode, usage tracking, validation

  ✅ PL-F1404a
• F14.04.02 Shipped

  Calendar integration (Google Calendar, Outlook, iCal) — CalendarIntegration CRUD, lifecycle, OAuth/API-key refs, sync direction (push/pull/bidirectional), sync state tracking, event type filtering

  ✅ PL-F1404a
• F14.04.03 Shipped

  Social media API integration (Facebook, Instagram, X) — SocialMediaIntegration CRUD, lifecycle, OAuth refs, page/account management, publish/analytics/moderation capabilities, auto-publish events

  ✅ PL-F1404a
• F14.04.04 Shipped

  Video streaming platform integration (YouTube, Twitch) — StreamingIntegration CRUD, lifecycle, API/stream-key refs, channel management, RTMP URL, DVR/chat/auto-record config

  ✅ PL-F1404a
• F14.04.05 Shipped

  Mapping/geolocation services (Google Maps, Mapbox) — MappingIntegration CRUD, lifecycle, API-key refs, geocoding/directions/static-maps/places-search toggles, domain allowlist, usage budget

  ✅ PL-F1404a
• F14.04.06 Shipped

  WADA/ADAMS integration for anti-doping — WadaAdamsIntegration CRUD, lifecycle (draft→active→paused→decommissioned), ADAMS API/signing-key refs, organization/sport codes, athlete pool management, whereabouts sync, TUE management, test result tracking, notification relay

  ✅ PL-F1404b
• F14.04.07 Shipped

  Insurance provider API integration — InsuranceIntegration CRUD, lifecycle, API/OAuth credential refs, broker/policy group IDs, coverage types, auto-enrollment, claims submission, premium calculation, certificate generation, sandbox mode

  ✅ PL-F1404b
• F14.04.08 Shipped

  Government sports registry integration (per country) — GovSportsRegistryIntegration CRUD, lifecycle, API/signing-certificate refs, federation code, country code (auto-uppercased), membership reporting, grant applications, facility registration, event reporting, compliance tracking, reporting schedule

  ✅ PL-F1404b
• F14.04.09 Shipped

  Accounting software integration (Fortnox, Xero, QuickBooks) — AccountingIntegration CRUD, lifecycle, OAuth/API-key refs, company ID, fiscal year config, sync direction (push/pull/bidirectional), chart of accounts mapping, invoice/payment/expense sync, VAT reporting, sandbox mode

  ✅ PL-F1404b

• F14.05.01 Shipped

  Bulk data export (CSV, JSON, Excel) — ExportJob CRUD, CSV/JSON/Excel format, configurable filters & columns, download lifecycle

  ✅ PL-F1405
• F14.05.02 Shipped

  Scheduled report generation and delivery — ScheduledExportJob CRUD, 6 frekvenser, pause/resume/trigger, webhook + e-post-leverans

  ✅ PL-F1405
• F14.05.03 Shipped

  Custom export templates — ExportTemplate CRUD, kolumnmappning med transform, delad/personlig, delimiter/encoding-konfiguration

  ✅ PL-F1405
• F14.05.04 Shipped

  Competition result export (federation-specific formats) — CompetitionExportJob, SBP CSV, FFPJP XML, DPV CSV, FIPJP JSON, generic CSV

  ✅ PL-F1405
• F14.05.05 Shipped

  GDPR data portability export — GdprPortabilityExport, Art. 20, JSON/CSV, 48h-utgång, dubblettskydd, nedladdningsspårning

  ✅ PL-F1405
• F14.05.06 Shipped

  Open data feeds (public statistics, rankings) — OpenDataFeed CRUD, JSON/CSV/RSS/Atom, slug-baserad åtkomst, caching, accessräknare

  ✅ PL-F1405

• F14.06.01 Shipped

  Embeddable results widget for federation/club websites — WidgetConfig (type: results), GET /public/widgets/{token} returns published CompetitionResult data with embed-friendly headers, tenant-scoped, configurable columns (balls, club)

  ✅ PL-F1406
• F14.06.02 Shipped

  Embeddable calendar widget — WidgetConfig (type: calendar), queries CalendarEvent with date range, event type filter, federation/club filter, configurable months ahead

  ✅ PL-F1406
• F14.06.03 Shipped

  Embeddable ranking widget — WidgetConfig (type: ranking), queries RankingEntry by config/dimension/category, show/hide club and rank change columns

  ✅ PL-F1406
• F14.06.04 Shipped

  Embeddable live score widget — WidgetConfig (type: live_score), queries Match for in_progress/scheduled matches, mène detail, court assignment, auto-refresh config

  ✅ PL-F1406
• F14.06.05 Shipped

  Widget customization (colors, branding) — WidgetCustomization with full color palette (8 colors), branding (logo, powered-by, custom footer), theme (light/dark/custom), size, locale, border radius, font family, max items, custom CSS

  ✅ PL-F1406
• F14.06.06 Shipped

  Widget embed code generator — POST /widgets/{id}/embed-code and GET /public/widgets/{token}/embed-code, generates iframe snippet (sandbox, lazy-load, referrerpolicy), JavaScript snippet, and direct URL with configurable dimensions

  ✅ PL-F1406

• F14.07.01 Shipped

  Stripe Payment Intents — StripePaymentIntent-samling tenant-scopad med stripe_payment_intent_id/stripe_client_secret/invoice_id/payment_id/amount/currency/status (requires_payment_method/requires_confirmation/requires_action/processing/succeeded/canceled/requires_capture)/payment_method_types/capture_method (automatic/manual)/metadata (StripePaymentIntentMetadata invoice_id/debtor_id/debtor_type/fee_category/season_id/custom)/connected_account_id/application_fee_amount/requires_action/description/stripe_customer_id; CRUD /stripe/payment-intents/ med filtrering status/invoice_id, confirm/capture/cancel/sync-endpoints

  ✅ PL-F1407
• F14.07.02 Shipped

  Stripe Connect — StripeTenantConnectAccount-samling tenant-scopad med stripe_account_id/account_type (standard/express/custom)/status (pending/onboarding/active/restricted/disabled)/entity_type (federation/club/org_node)/entity_id/country/default_currency/display_name/onboarding (StripeConnectOnboarding requirements_due/payouts_enabled/charges_enabled/details_submitted)/platform_fee_percent; CRUD /stripe/connect/ med filtrering status/entity_type, account-link/refresh/disable-endpoints

  ✅ PL-F1407
• F14.07.03 Shipped

  Stripe Webhooks — StripeWebhookEvent-samling tenant-scopad med stripe_event_id/event_type/status (received/verified/failed_verification/processed/processing_failed)/signature_valid/idempotency_key/payload/processing_error; POST /stripe/webhooks/ med signaturverifiering mot STRIPE_WEBHOOK_SECRET, idempotens-kontroll, dispatch till handlers (payment_intent.succeeded/failed/canceled/requires_action, charge.refunded, refund.updated, account.updated); GET /stripe/webhooks/events för audit-loggning

  ✅ PL-F1407
• F14.07.04 Shipped

  Stripe SCA / 3D Secure — StripeScaChallenge-samling tenant-scopad med stripe_payment_intent_id/status (not_required/required/initiated/succeeded/failed)/three_ds_version/authentication_flow (challenge/frictionless)/failure_reason/initiated_at/completed_at; CRUD /stripe/sca/, POST /stripe/sca/{stripe_pi_id}/complete med success/failure_reason

  ✅ PL-F1407
• F14.07.05 Shipped

  Stripe Refunds — StripeRefund-samling tenant-scopad med stripe_refund_id/stripe_payment_intent_id/invoice_id/refund_type (full/partial)/amount/currency/status (pending/succeeded/failed/canceled/requires_action)/reason (duplicate/fraudulent/requested_by_customer)/description; CRUD /stripe/refunds/ med filtrering status/invoice_id/payment_intent_id, sync-endpoint

  ✅ PL-F1407
• F14.07.06 Shipped

  Stripe Tax — StripeTaxConfig-samling tenant-scopad med country/tax_behavior (inclusive/exclusive)/tax_code/tax_id/tax_id_type/automatic_tax_enabled/tax_rates[StripeTaxRate display_name/percentage/inclusive/country/tax_type/stripe_tax_rate_id]/tax_registrations[]/head_office_address/status (active/inactive/deleted); CRUD /stripe/tax/configs, registrations/sync-rates/calculate-endpoints med per-tenant momsberäkning (SE 25% exclusive, FR 20% inclusive, DE 19% exclusive)

  ✅ PL-F1407

• F14.08.01 Shipped

  PayPal Checkout — PayPalOrder-samling tenant-scopad med paypal_order_id/intent (capture/authorize)/status (created/saved/approved/voided/completed/payer_action_required)/invoice_id/payment_id/amount/currency/purchase_units[PayPalPurchaseUnit]/payer_email/payer_id/capture_id/authorization_id/approval_url/metadata (PayPalOrderMetadata invoice_id/debtor_id/debtor_type/fee_category/season_id/custom)/brand_name/sandbox/express_profile_id; CRUD /paypal/orders/ med filtrering status/invoice_id/payer_id, capture/void/sync-endpoints

  ✅ PL-F1408
• F14.08.02 Shipped

  PayPal IPN/Webhooks — PayPalWebhookEvent-samling tenant-scopad med paypal_event_id/event_type/resource_type/status (received/verified/failed_verification/processed/processing_failed)/signature_valid/idempotency_key/related_resource_id/related_order_id/webhook_id/processing_error; POST /paypal/webhooks/ med signaturverifiering via PayPal Notifications API, idempotens-kontroll, dispatch till handlers (CHECKOUT.ORDER.APPROVED/COMPLETED/DECLINED, PAYMENT.CAPTURE.COMPLETED/DENIED/REFUNDED/REVERSED/PENDING); GET /paypal/webhooks/events för audit-loggning

  ✅ PL-F1408
• F14.08.03 Shipped

  PayPal Refunds — PayPalRefund-samling tenant-scopad med paypal_refund_id/paypal_capture_id/paypal_order_id/order_doc_id/invoice_id/refund_type (full/partial)/amount/currency/status (pending/completed/failed/cancelled)/reason/note_to_payer/seller_payable_breakdown; CRUD /paypal/refunds/ med filtrering status/capture_id/order_id/invoice_id, sync-endpoint

  ✅ PL-F1408
• F14.08.04 Shipped

  PayPal Express för one-click — PayPalExpressProfile-samling tenant-scopad med user_id/paypal_payer_id/payer_email/payment_token (vault token)/consent_status (pending/active/revoked/expired)/display_name/preferred/last_used_at; CRUD /paypal/express/profiles med activate/revoke/set-preferred-endpoints, integration med PayPal Vault API för sparade betalningskällor

  ✅ PL-F1408

• F14.09.01 Shipped

  Swish QR-betalningar (Sverige) — SwishPaymentRequest-samling tenant-scopad med swish_instruction_uuid indexed/payee_alias/payer_alias/amount Decimal/currency SEK/message (max 50)/status (created/paid/declined/error/cancelled)/qr_code_data base64/qr_format/callback_url/invoice_id/payment_id/payment_reference/payer_payment_reference/error_code/error_message/paid_at/metadata (SwishPaymentMetadata invoice_id/debtor_id/debtor_type/fee_category/season_id/custom); CRUD /swish/payments/ med filtrering status/invoice_id, cancel/sync-endpoints; valutavalidering (enbart SEK); QR-kodgenerering vid skapande

  ✅ PL-F1409a
• F14.09.02 Shipped

  Swish webhook callbacks — SwishCallbackEvent-samling tenant-scopad med swish_instruction_uuid indexed/event_status (PAID/DECLINED/ERROR/CANCELLED)/callback_identifier indexed för idempotens/status (received/verified/processed/processing_failed)/payload_summary saniterad/processing_error/payer_alias/payment_reference/amount/date_paid; POST /swish/callbacks/ tar emot Swish-callbacks med idempotens-kontroll, dispatch till handlers som uppdaterar SwishPaymentRequest och skapar Payment+Receipt vid PAID; GET /swish/callbacks/events för audit-loggning

  ✅ PL-F1409a
• F14.09.03 Shipped

  iDEAL (Nederländerna) — IDealPayment-samling tenant-scopad med ideal_transaction_id indexed/provider (stripe/mollie)/provider_payment_id/bank_bic/bank_name/amount Decimal/currency EUR/status (created/pending/succeeded/failed/expired/canceled)/invoice_id/payment_id/redirect_url/return_url/webhook_url/description/metadata (IDealPaymentMetadata)/succeeded_at/failed_at/error_code/error_message; CRUD /ideal/payments/ med filtrering status/invoice_id, sync-endpoint, webhook-endpoint; valutavalidering (enbart EUR); skapar Payment+Receipt vid succeeded

  ✅ PL-F1409a
• F14.09.04 Shipped

  Bancontact (Belgien) — BancontactPayment-samling tenant-scopad med bancontact_transaction_id indexed/provider (stripe/mollie)/provider_payment_id/cardholder_name/preferred_language (nl/fr/de/en)/amount Decimal/currency EUR/status (created/pending/authorized/succeeded/failed/expired/canceled)/invoice_id/payment_id/redirect_url/return_url/description/metadata (BancontactPaymentMetadata)/succeeded_at/failed_at/error_code/error_message; CRUD /bancontact/payments/ med filtrering status/invoice_id, sync-endpoint, webhook-endpoint; valutavalidering (enbart EUR); skapar Payment+Receipt vid succeeded

  ✅ PL-F1409a
• F14.09.05 Shipped

  Bizum (Spanien) — BizumPayment-samling tenant-scopad med bizum_transaction_id indexed/provider (stripe/redsys)/provider_payment_id/payer_phone/amount Decimal/currency EUR/status (created/pending/paid/failed/cancelled/timeout)/qr_code_data base64/qr_format/invoice_id/payment_id/redirect_url/return_url/description/metadata (BizumPaymentMetadata)/paid_at/failed_at/error_code/error_message; CRUD /bizum/payments/ med filtrering status/invoice_id, sync-endpoint, webhook-endpoint; valutavalidering (enbart EUR); QR-kodgenerering; skapar Payment+Receipt vid paid

  ✅ PL-F1409b
• F14.09.06 Shipped

  SEPA Direct Debit (EUR-länder) — SepaDirectDebitPayment-samling tenant-scopad med sepa_transaction_id indexed/provider (stripe/mollie)/provider_payment_id/mandate_id indexed/mandate_status (pending/active/revoked/expired)/debtor_iban/debtor_name/creditor_id/amount Decimal/currency EUR/status (pending/authorized/processing/succeeded/failed/reversed/cancelled)/sequence_type (OOFF/RCUR/FRST/FNAL)/invoice_id/payment_id/description (max 140)/return_url/redirect_url/return_code (R01-R99)/metadata (SepaDirectDebitMetadata)/succeeded_at/failed_at/error_code/error_message; CRUD /sepa-direct-debit/payments/ med filtrering status/invoice_id/mandate_id, sync-endpoint, webhook-endpoint; mandathantering; SEPA-returkoder; valutavalidering (enbart EUR); skapar Payment+Receipt vid succeeded

  ✅ PL-F1409b
• F14.09.07 Shipped

  Klarna BNPL (EU) — KlarnaPayment-samling tenant-scopad med klarna_order_id indexed/provider (klarna/stripe)/provider_payment_id/klarna_session_id/purchase_country (18 länder)/purchase_language/amount Decimal/currency (EUR/SEK/NOK/DKK/GBP/USD/CHF/PLN/CZK)/status (created/authorized/captured/failed/cancelled/expired)/payment_type (pay_later/pay_over_time/direct_debit/direct_bank_transfer)/installment_count (2–36)/invoice_id/payment_id/redirect_url/return_url/description/customer_email/metadata (KlarnaPaymentMetadata)/authorized_at/captured_at/failed_at/error_code/error_message; CRUD /klarna/payments/ med filtrering status/invoice_id/payment_type, capture-endpoint, sync-endpoint, webhook-endpoint; lands- och valutavalidering; tvåstegsflöde (authorize→capture); skapar Payment+Receipt vid captured

  ✅ PL-F1409b

• F14.10.01 Shipped

  Fortnox API (Sverige) — AccountingProviderConfig (provider=fortnox) med FortnoxConfig (client_id_ref/client_secret_ref/access_token_ref/refresh_token_ref/company_id/default_account_plan BAS2024/auto_create_customers/auto_bookkeep_invoices); AccountingSyncJob för batch-push av fakturor/betalningar/kunder till Fortnox API med idempotent AccountingSyncMapping, hashbaserad ändringsdetektering, dry-run-stöd; AccountingWebhookEvent med HMAC-SHA256-signaturverifiering för Fortnox webhooks

  ✅ PL-F1410
• F14.10.02 Shipped

  Xero API (internationell) — AccountingProviderConfig (provider=xero) med XeroConfig (client_id_ref/client_secret_ref/access_token_ref/refresh_token_ref/xero_tenant_id/tracking_category_id/auto_create_contacts/branding_theme_id); faktura/betalning/kontakt-sync till Xero REST API, OAuth2-tokenhantering, webhook-mottagning med idempotens

  ✅ PL-F1410
• F14.10.03 Shipped

  Visma eEkonomi (Sverige) — AccountingProviderConfig (provider=visma) med VismaConfig (client_id_ref/client_secret_ref/access_token_ref/refresh_token_ref/company_id/fiscal_year_id/auto_create_customers); faktura/betalning/kund-sync till Visma eAccountingAPI

  ✅ PL-F1410
• F14.10.04 Shipped

  QuickBooks (US/UK) — AccountingProviderConfig (provider=quickbooks) med QuickBooksConfig (client_id_ref/client_secret_ref/access_token_ref/refresh_token_ref/realm_id/minor_version/sandbox_mode/auto_create_customers); faktura/betalning/kund-sync till QuickBooks Online API

  ✅ PL-F1410
• F14.10.05 Shipped

  SIE4-fil-export (svensk standard) — SIE4Export med livscykel (pending→generating→completed/failed), #FLAGGA 0/#PROGRAM/#FORMAT PC8/#GEN/#SIETYP 4/#FNR/#FNAMN/#RAR/#KONTO/#IB/#UB/#VER/#TRANS; konfigurerbar räkenskapsår, datumfilter, öppnings-/stängningssaldon, periodbalans; POST /accounting/sie4-exports/ genererar och returnerar metadata, GET .../download returnerar filinnehåll

  ✅ PL-F1410
• F14.10.06 Shipped

  Per-tenant kontoplansmappning — ProviderAccountMapping med livscykel (draft→active→archived), AccountMappingRule (internal_category/internal_account_number/provider_account_code/provider_account_name/vat_code/cost_centre), validering (dubbletter, numerisk kontroll för Fortnox), BAS2024-standardmappningar för 8 kategorier (licensavgifter/tävlingsavgifter/klubbavgifter/medlemsavgifter/sponsorintäkter/bidrag/resekostnader/förbrukningsinventarier), sync-to-provider

  ✅ PL-F1410

• F14.11.01 Shipped

  Google Maps embed för venue-sidor — MapEmbedConfig-samling tenant-scopad med venue_id/embed_type (google_maps_embed/google_maps_static/mapbox_gl/mapbox_static/openstreetmap)/style (MapEmbedStyle zoom/map_type/width/height/show_marker/marker_label/custom_style_url)/mapping_integration_id/show_nearby_clubs/nearby_radius_km/show_directions_link/show_street_view/custom_marker_icon_url; GET /geo/venues/{venue_id}/embed genererar embed-URL med adress, koordinater och directions-länk; GET /geo/venues/{venue_id}/embed-config + PATCH för konfigurationshantering

  ✅ PL-F1411
• F14.11.02 Shipped

  Mapbox alternativ med vector tiles — Mapbox GL JS-konfiguration med style_url (mapbox://styles/mapbox/streets-v12), center, zoom, markers; generate_mapbox_embed_config() returnerar fullständig klientkonfiguration; generate_mapbox_static_url() för statiska kartbilder via Mapbox Static Images API; stöd för OpenStreetMap som gratis fallback utan API-nyckel

  ✅ PL-F1411
• F14.11.03 Shipped

  Geocoding för venue-adresser — GeocodingResult-samling tenant-scopad med direction (forward/reverse)/provider (google_maps/mapbox/openstreetmap/here)/input_address/coordinates (GeoCoordinates lat/lng)/address (GeocodedAddress formatted_address/street/city/postal_code/country/country_code/region)/confidence 0.0–1.0/cached_at/expires_at/mapping_integration_id; POST /geo/geocode med cachning, provider-val och integration mot MappingIntegration

  ✅ PL-F1411
• F14.11.04 Shipped

  Reverse geocoding för spelarposition — POST /geo/reverse-geocode med lat/lng input, cachning med ~100m bounding-box matchning, returnerar GeocodedAddress med strukturerad adress; stöd för Google Maps och Mapbox providers; tenant-scopad cachning med TTL

  ✅ PL-F1411
• F14.11.05 Shipped

  Route-beräkning till tävlingsvenues — RouteCalculation-samling tenant-scopad med provider/travel_mode (driving/walking/cycling/transit)/origin (GeoCoordinates)/destination (GeoCoordinates)/venue_id/status (ok/not_found/zero_results/error)/summary (RouteSummary total_distance_m/total_duration_s/total_distance_km/total_duration_min)/steps[RouteStep]/polyline/cached_at/expires_at; POST /geo/route med haversine-baserad uppskattning, cachning med ~500m tolerans

  ✅ PL-F1411
• F14.11.06 Shipped

  Klubb-finder med radius-sökning — GET /public/clubs/nearby publik endpoint utan autentisering med lat/lng/radius_km (0.5–500)/level/facilities (kommaseparerad)/skip/limit (1–100); bounding-box pre-filter på venue-koordinater sedan exakt haversine-avstånd; resultat sorterade efter avstånd (närmast först); ClubFinderResult med club_id/club_name/club_code/distance_km/location/address/city/facilities/level/venue_id/venue_name; cross-tenant som standard, tenant-scopad med valfri tenant_id-parameter

  ✅ PL-F1411

• F14.12.01 Shipped

  WADA ADAMS export — AdamsIntegrationConfig-samling tenant-scopad med display_name/credentials (AdamsCredentialRefs api_key_ref/api_secret_ref/signing_key_ref/endpoint_url)/organisation_code/sport_code/enable_athlete_export/enable_whereabouts_sync/enable_test_result_import/enable_tue_sync/registered_testing_pool_ids/testing_pool_ids/sandbox_mode; CRUD /anti-doping/adams-configs/ med enable/disable-endpoints; AdamsExportJob-samling tenant-scopad med config_id/entity_type (athlete_profile/whereabouts/test_result/tue_application/sanction)/status (pending/exporting/completed/completed_with_errors/failed/cancelled)/dry_run/statistics (AdamsExportStatistics total/succeeded/failed/skipped)/results[AdamsExportResult]; CRUD /anti-doping/export-jobs/ med run/cancel-endpoints; hashbaserad ändringsdetektering för idempotent export

  ✅ PL-F1412
• F14.12.02 Shipped

  Whereabouts upload — WhereaboutsRecord-samling tenant-scopad med player_id/adams_athlete_id/quarter_year/quarter_number/entries[WhereaboutsEntry slot_date/slot_type (overnight/training/competition/other/sixty_minute)/start_time/end_time/address/city/country_code]/status (draft/submitted/confirmed/rejected/expired/cancelled)/submitted_at/confirmed_at/rejected_reason/adams_submission_id/sync_hash; CRUD /anti-doping/whereabouts/ med submit/confirm/reject-livscykel; tidsvalidering HH:MM, auto-uppercase country_code

  ✅ PL-F1412
• F14.12.03 Shipped

  Test result import — TestResultImport-samling tenant-scopad med player_id/adams_test_id/source_provider (NadoProvider)/source_reference/detail (TestResultDetail sample_code/sample_type/collection_date/lab_name/lab_code/substances_detected/result_code/b_sample_requested/b_sample_result)/test_type/competition_id/status (received/validated/processed/failed/rejected)/linked_doping_test_id/idempotency_key; CRUD /anti-doping/test-results/ med validate/process-livscykel; process skapar DopingTest-record med korrekt resultatmappning (negative/adverse→positive/atypical/pending); idempotens via idempotency_key

  ✅ PL-F1412
• F14.12.04 Shipped

  TUE application sync — TueSyncRecord-samling tenant-scopad med tue_application_id/player_id/direction (push/pull)/status (pending/syncing/synced/failed/conflict)/adams_tue_id/adams_status/sync_hash/conflict_field/local_value/remote_value; CRUD /anti-doping/tue-syncs/ med execute-endpoint; push exporterar lokal TUE till ADAMS, pull hämtar ADAMS-beslut och uppdaterar lokalt; konfliktdetektering

  ✅ PL-F1412
• F14.12.05 Shipped

  Per-nation anti-doping-byrå-koppling — NadoConfig-samling tenant-scopad med provider (rf_antidoping/afld/nada_de/ukad/usada/nadof/nada_at/wada/other)/country_code (auto-uppercase)/contact (NadoContactInfo organisation_name/website/email/phone/address/dco_contact_email/reporting_portal_url)/has_api/api_key_ref/api_endpoint_url/code_version/whereabouts_required/tue_committee_email/notify_on_adverse_finding/notify_on_whereabouts_failure; CRUD /anti-doping/nado-configs/ med enable/disable-endpoints; GET /defaults returnerar standardkonfigurationer för SE/FR/DE; AntiDopingWebhookEvent-samling med HMAC-SHA256-signaturverifiering per provider, idempotens-kontroll, dispatch till handlers (test_result.*/tue.*/whereabouts.*); POST /anti-doping/webhooks/{provider} + GET /anti-doping/webhooks/events audit-logg

  ✅ PL-F1412

• F14.13.01 Shipped

  SendGrid transactional email — SendGridConfig-samling tenant-scopad med display_name/credentials (SendGridCredentialRefs api_key_ref/webhook_signing_key_ref)/from_email/from_name/reply_to_email/enable_open_tracking/enable_click_tracking/enable_unsubscribe_tracking/ip_pool_name/sandbox_mode/usage (UsageMetrics); CRUD /communication/sendgrid/configs/ med livscykel (draft→active→paused→error→decommissioned); EmailMessage-samling med config_id/provider/to[EmailRecipient]/subject/template_id/template_data/body_text/body_html/status/engagement (EmailEngagementMetrics)/bounce_type/idempotency_key; POST /communication/sendgrid/emails/ skickar via SendGrid v3 API

  ✅ PL-F1413
• F14.13.02 Shipped

  ELKS SMS för svenska nummer — ElksConfig-samling tenant-scopad med display_name/credentials (ElksCredentialRefs api_username_ref/api_password_ref)/sender_id (max 11 tecken GSM)/default_country_code (+46)/dlr_callback_url/usage; SmsMessage-samling med direction (outbound/inbound)/from_number/to (SmsRecipient)/body (max 1600)/segments/cost_amount/cost_currency SEK/idempotency_key; POST /communication/elks/sms/ skickar via 46elks API

  ✅ PL-F1413
• F14.13.03 Shipped

  Firebase Cloud Messaging för push — FcmConfig-samling tenant-scopad med credentials (FcmCredentialRefs service_account_json_ref/project_id)/default_ttl_seconds/default_priority/usage; PushNotification-samling med target (PushTarget device_token/platform/player_id)/topic/title/body/image_url/data/priority/ttl_seconds/collapse_key/badge_count/sound/click_action/idempotency_key; POST /communication/fcm/push/ skickar via FCM v1 API

  ✅ PL-F1413
• F14.13.04 Shipped

  Twilio SMS som international fallback — TwilioConfig-samling tenant-scopad med credentials (TwilioCredentialRefs account_sid_ref/auth_token_ref/messaging_service_sid)/from_number E.164/status_callback_url/supported_countries[]/usage; SmsMessage (delad med ELKS) med provider=twilio; POST /communication/twilio/sms/ skickar via Twilio Messages API

  ✅ PL-F1413
• F14.13.05 Shipped

  Mailgun som backup till SendGrid — MailgunConfig-samling tenant-scopad med credentials (MailgunCredentialRefs api_key_ref/webhook_signing_key_ref/domain/region eu

  us)/from_email/from_name/enable_tracking/enable_click_tracking/test_mode/usage; EmailMessage (delad med SendGrid) med provider=mailgun; POST /communication/mailgun/emails/ skickar via Mailgun v3 API | ✅ PL-F1413
• F14.13.06 Shipped

  WhatsApp Business API för notiser — WhatsAppConfig-samling tenant-scopad med credentials (WhatsAppCredentialRefs access_token_ref/phone_number_id/business_account_id/webhook_verify_token_ref)/display_phone_number/business_name/default_language_code BCP 47/usage; WhatsAppMessage-samling med to (WhatsAppRecipient)/message_type (template/text)/template_name/template_language/template_parameters[]/body_text/media_url/read_at/idempotency_key; POST /communication/whatsapp/messages/template och /text skickar via WhatsApp Cloud API v18.0; CommunicationWebhookEvent med signaturverifiering (HMAC-SHA256/SHA1), idempotens-kontroll, dispatch till email/sms/whatsapp-handlers

  ✅ PL-F1413

• F14.14.01 Shipped

  YouTube Live embed — YouTubeLiveEmbed-samling tenant-scopad med name/channel_id/video_id/api_key_ref/privacy (public/unlisted/private)/player_params (YouTubePlayerParams autoplay/mute/controls/loop/modest_branding/rel/fs/cc_load_policy)/embed_width/embed_height/responsive/allowed_domains/competition_id/live_chat_embed/enabled; CRUD /youtube-embeds/ med filtrering enabled/competition_id; GET /{id}/embed genererar embed-URL och iframe-HTML med responsiv 16:9 container; GET /{id}/validate validerar konfiguration (video_id/channel_id-format); live chat iframe-URL vid live_chat_embed=true

  ✅ PL-F1414
• F14.14.02 Shipped

  Twitch embed — TwitchEmbed-samling tenant-scopad med name/channel_name/video_id/collection_id/layout (video/video_with_chat)/player_params (TwitchPlayerParams autoplay/muted/allow_fullscreen/time)/parent_domains (obligatorisk)/embed_width/embed_height/responsive/competition_id/theme (dark/light)/enabled; CRUD /twitch-embeds/ med filtrering enabled/competition_id; GET /{id}/embed genererar embed-URL med parent-domain-säkerhet; GET /{id}/validate validerar channel_name-format och parent_domains; chat-embed-URL vid layout=video_with_chat

  ✅ PL-F1414
• F14.14.03 Shipped

  RTMP relay-konfiguration — RtmpRelayConfig-samling tenant-scopad med name/status (draft/active/paused/error/decommissioned)/ingest_protocol (rtmp/rtmps/srt)/ingest_url/ingest_key_ref/destinations[RtmpRelayDestination name/platform/rtmp_url/stream_key_ref/enabled/bitrate_kbps/resolution] (max 5)/max_bitrate_kbps/transcoding_enabled/recording_enabled/competition_id; CRUD /rtmp-relays/ med filtrering status/competition_id; livscykel activate/pause/decommission med statusvakter (409); URL-validering (rtmp://rtmps://srt://)

  ✅ PL-F1414
• F14.14.04 Shipped

  Stream metadata API — StreamMetadata-samling tenant-scopad med title/stream_type (live/vod/clip)/status (scheduled/live/ended/processing/available/error/archived)/platform/platform_stream_id/platform_url/thumbnail_url/embed_url/competition_id/match_id/language/tags[]/scheduled_start_at/actual_start_at/ended_at/duration_seconds/viewer_stats (StreamViewerStats peak_concurrent/total_views/average_watch_time_s/unique_viewers)/is_featured/is_public; CRUD /stream-metadata/ med filtrering stream_type/status/platform/competition_id/is_featured/is_public; livscykel start/end/available/archive med statusvakter; viewer-stats endpoint med peak_concurrent max-beräkning

  ✅ PL-F1414
• F14.14.05 Shipped

  Vimeo för on-demand replay — VimeoReplay-samling tenant-scopad med name/status (draft/uploading/transcoding/available/error/archived)/vimeo_video_id/vimeo_uri/api_token_ref/privacy (anybody/nobody/password/unlisted/disable)/password_ref/embed_responsive/embed_width/embed_height/embed_autoplay/embed_loop/embed_title/embed_byline/embed_portrait/embed_color/allowed_domains/competition_id/match_id/duration_seconds/file_size_bytes/download_enabled; CRUD /vimeo-replays/ med filtrering status/competition_id; livscykel available/archive; GET /{id}/embed genererar Vimeo embed-URL med parametrar; GET /{id}/validate kontrollerar video_id/api_token/password

  ✅ PL-F1414
• F14.14.06 Shipped

  Cloudflare Stream för egen leverans — CloudflareStreamConfig-samling tenant-scopad med name/status (draft/ready/live_input_created/connected/disconnected/error/decommissioned)/mode (live/on_demand)/account_id_ref/api_token_ref/cf_stream_id/cf_live_input_id/rtmp_url/rtmp_key_ref/srt_url/webrtc_url/playback_hls_url/playback_dash_url/signed_url_config (SignedUrlConfig signing_key_ref/token_ttl_seconds/require_signed_urls)/allowed_origins[CloudflareStreamAllowedOrigin]/recording_enabled/require_signed_urls/max_duration_seconds/competition_id; CRUD /cloudflare-streams/ med filtrering status/mode/competition_id; livscykel activate/create-live-input/decommission; HMAC-SHA256 signed playback URL-generering med konfigurerbar TTL

  ✅ PL-F1414

**Plattform-CMS-trafik (`*.web.petanque.life` + custom domains) routas via Caddy reverse proxy** på Azure VM `vm-petanque-proxy` (`20.238.51.13`) — hanterar TLS-termination för obegränsat antal CMS-sajter framför `swa-petanque-web`. On-demand TLS via Let's Encrypt HTTP-01, cert-persistens i Docker-volym `caddy_data`. Cert-utfärdande gateas av `GET /public/domains/cert-allowed?domain=<host>` (api.petanque.life) som returnerar 200 om hostname matchar aktiv `CmsSite.subdomain`/`CmsSite.domain` eller verifierad `CmsCustomDomain`. Federationer pekar sin egen domän mot CNAME-target `proxy.web.petanque.life`. Se `docs/engineering/architecture/05a-dns-and-tls.md` och `specs/infrastructure/caddy-proxy.md`.

• F14.15.01 Shipped

  ACME/Let's Encrypt certificate management — AcmeCertificate-samling tenant-scopad med automatisk certifikatutfärdande och förnyelse; för CMS-trafik: Caddy-baserad on-demand TLS via HTTP-01 challenge på vm-petanque-proxy med cert-persistens i Docker-volym (PL-T232)

  ✅ PL-F1415 + PL-T232
• F14.15.02 Shipped

  Cloudflare DNS zone management — CloudflareDnsZone-samling tenant-scopad med zone CRUD och DNS-posthantering

  ✅ PL-F1415
• F14.15.03 Shipped

  Cloudflare DNS record management — CloudflareDnsRecord-samling tenant-scopad med A/AAAA/CNAME/MX/TXT-poster

  ✅ PL-F1415
• F14.15.04 Shipped

  Domain verification — DomainVerification-samling tenant-scopad med TXT/CNAME-verifieringsmetoder, WildcardCertificate för wildcard-certifikat

  ✅ PL-F1415
• F14.15.05 Shipped

  Cloudflare Workers för edge computing — CloudflareWorkerDeployment-samling tenant-scopad med worker-konfiguration och deployment-hantering

  ✅ PL-F1415
• F14.15.06 Shipped

  Caddy reverse proxy för CMS-trafik — vm-petanque-proxy Azure VM (B1s, statisk IP 20.238.51.13) kör Caddy 2.x i Docker; on-demand TLS via Let's Encrypt HTTP-01; cert-cache i volym caddy_data; reverse-proxy med header_up Host {host} till swa-petanque-web; gateas av /public/domains/cert-allowed-endpoint mot abuse; stabilt CNAME-target proxy.web.petanque.life för federationers egna domäner; ersätter Cloudflare for SaaS (PL-T046) som vilande alternativ (PL-T232)

  ✅ PL-T232
• F14.15.07 Shipped

  Loopia DNS API-integration för auto-provisionering av plattform-subdomäner — services/sys/loopia_dns (XML-RPC mot https://api.loopia.se/RPCSERV) hookas in i POST/PATCH/DELETE /cms/sites/ så A-record <slug>.web.petanque.life → 20.238.51.13 skapas, byts eller tas bort automatiskt vid CmsSite-livscykelhändelser; dns_provisioning_status (pending/active/failed/disabled) + dns_provisioning_error + dns_provisioned_at på CmsSite för observability; POST /cms/sites/{id}/repair-dns för idempotent retry; reserverade slugs (proxy, _acme-challenge, test) blockerade; transient API-fel rullar inte tillbaka CmsSite-creation (PL-T235)

  ✅ PL-T235

## F14.01 (additions) — PL-T215

• F14.16.01 Shipped

  Plausible analytics (privacy-respecting) — PlausibleConfig-samling tenant-scopad med display_name/credentials (PlausibleCredentialRefs api_key_ref)/site_id/instance_url (cloud eller self-hosted)/enable_custom_events/enable_revenue_tracking/allowed_domains/usage (AnalyticsUsageMetrics); CRUD /analytics/plausible/configs/ med livscykel (draft→active→paused→error→decommissioned); AnalyticsEvent-samling med config_id/provider/event_name/event_properties/user_id/anonymous_id/page_url/referrer/user_agent/idempotency_key; POST /analytics/plausible/events/ skickar via Plausible Events API; GDPR-kompatibel utan cookies

  ✅ PL-F1416
• F14.16.02 Shipped

  Umami analytics som självhostat alternativ — UmamiConfig-samling tenant-scopad med display_name/credentials (UmamiCredentialRefs api_key_ref/username_ref/password_ref)/instance_url/website_id/share_url/enable_custom_events/track_outbound_links/usage; CRUD /analytics/umami/configs/ med livscykel; POST /analytics/umami/events/ skickar via Umami Collect API; privacy-fokuserad, cookiefri

  ✅ PL-F1416
• F14.16.03 Shipped

  Google Analytics 4 (opt-in per tenant) — GA4Config-samling tenant-scopad med display_name/credentials (GA4CredentialRefs measurement_id/api_secret_ref/service_account_json_ref)/property_id/data_stream_id/require_cookie_consent (default true)/anonymize_ip/enable_enhanced_measurement/enable_ecommerce/debug_mode/usage; CRUD /analytics/ga4/configs/ med livscykel; POST /analytics/ga4/events/ skickar via GA4 Measurement Protocol med client_id; kräver cookie-samtycke (analytics-kategori) innan spårning aktiveras

  ✅ PL-F1416
• F14.16.04 Shipped

  Per-tenant cookie consent — CookieConsentConfig-samling tenant-scopad med display_name/status/banner (ConsentBannerConfig position/style/primary_color/background_color/text_color/show_reject_all/show_preferences)/categories (necessary/functional/analytics/marketing med ConsentCategoryConfig enabled/required/default_accepted/display_name/description/cookie_names)/privacy_policy_url/cookie_policy_url/consent_expiry_days (1–730)/geo_targeting_enabled/respect_do_not_track; CRUD /analytics/cookie-consent/configs/ med PATCH-uppdatering; integrerar med befintlig CookieConsentRecord (privacy.py) för individuella samtyckesbeslut

  ✅ PL-F1416
• F14.16.05 Shipped

  PostHog event tracking integration for product analytics, feature flags, and funnel analysis with per-tenant configuration

  ✅ PL-F1416
• F14.16.06 Shipped

  API usage analytics aggregation per developer/tier — RateLimitWindow flushes till ApiUsageRecord-buckets; admin /admin/api/usage-vy med stacked area chart per tier, drilldown per utvecklare

  ✅ PL-T215
• F14.16.07 Shipped

  Per-record provenance metadata — _meta.dataset_version + _meta.provenance_uri + field_provenance på alla data-product-svar för spårning av källdataset och version

  ✅ PL-T215
• F14.01.10 Shipped

  Developer portal self-service — POST /developer/keys, GET/DELETE /developer/keys/{id}, GET /developer/keys/{id}/usage med 256-bit-key + SHA-256-hash; X-Developer-Id-bootstrap-header för första key-issuance

  ✅ PL-T215
• F14.01.11 Shipped

  Sandbox-tenant provisioning — POST /developer/sandbox med 4 seed-templates (minimal, national_federation, club, competition_in_progress), separat Cosmos-databas, 30-dagars auto-expiry, 10× rate-limit

  ✅ PL-T215
• F14.01.12 Shipped

  OAuth 2.0 client-credentials grant — POST /v1/oauth/token med scope-baserad authorization (api:read, webhooks:write, data:integrity etc.); 3600s opaque token-livslängd; key-id-blacklist vid revoke

  ✅ PL-T215
• F14.01.13 Shipped

  Public OpenAPI surface — GET /v1/openapi.json filtrerat till canonical tags (CANONICAL_DOMAINS frozenset i domains.py)

  ✅ PL-T215
• F14.01.14 Shipped

  API-versionering policy + middleware — /v{N} URL-prefix, X-API-Version/X-API-Version-Deprecated/Sunset headers, route-aware aliasing (explicit /v1/X-routes passerar genom oförändrade)

  ✅ PL-T215
• F14.01.15 Shipped

  Sliding-window rate-limit per client + tier — Redis sorted-set per (client_id, bucket); per-endpoint-buckets (default, webhook_management, data_product_query, oauth_token); fail-open vid Redis-utfall

  ✅ PL-T215
• F14.01.16 Shipped

  Legacy federation field-mapping — dokumentation per nation (SBF/NBoF/FFPJP/FBP/FIB/FEP) + FIPJP/CEP, tenant.field_mapping_overrides för per-fält translations utan kodändring

  ✅ PL-T215
• F14.03.07 Shipped

  Webhook signed payload v2 — canonical f"{timestamp}.{body}" HMAC-SHA256 (Stripe-format), 5min replay-fönster, X-Petanque-Signature/-Timestamp/-Event-Id/-Delivery/-Attempt-headers

  ✅ PL-T215
• F14.03.08 Shipped

  Self-service webhook CRUD + debugging — POST/GET/DELETE /developer/webhooks, GET /webhooks/{id}/deliveries med per-delivery-status, POST /test-endpoint, POST /deliveries/{id}/replay med X-Petanque-Replay-Of-header

  ✅ PL-T215
• F14.03.09 Shipped

  DLQ + auto-disable — efter 8 retries (exponential backoff base=30s) flyttas leverans till DLQ; endpoint auto-disablas efter 24h med 100% failure-rate (disabled_reason="too_many_failures")

  ✅ PL-T215
• F14.03.10 Shipped

  Sandbox-säker webhook-routing — sandbox-tenants kan endast skicka webhooks till whitelist (webhook.site-domän) eller utvecklarens egen URL, aldrig till partner-system konfigurerade i production

  ✅ PL-T215
• F14.03.11 Shipped

  ed25519-overlay för integrity-events — X-Petanque-Signature: ed25519:<key_id>=<hex> som tillägg till HMAC; kvartalsvis key-rotation; public key via GET /v1/integrity/public-key

  ✅ PL-T215
• F14.04.10 Shipped

  Insurance risk-feed (aggregerad) — GET /v1/insurance/snapshots/{period} med månads-/kvartalssnapshots; competitions/venues/incidents-aggregat per region (NUTS-2), surface, capacity-band; väderdata per outdoor-event-hours; inga PII

  ✅ PL-T215
• F14.05.07 Shipped

  GraphQL analytics-endpoint — POST /v1/analytics/graphql query-only med complexity-limit (count("{")*10 + count("(")*2, default 1000); per-tier-tak; field-level scope-gating

  ✅ PL-T215
• F14.05.08 Shipped

  Research cohort query — POST /v1/research/cohorts/{id}/query med pseudonymized k=5-anonymity, consent-version per record, ethics-committee-approval-flow

  ✅ PL-T215
• F14.05.09 Shipped

  Integrity event stream (SSE) — GET /v1/integrity/events/{event_id}/stream med Last-Event-ID-reconnect, p50<250ms latency-SLA, 15s heartbeat

  ✅ PL-T215
• F14.05.10 Shipped

  Sanctions-list för betting-operatörer — GET /v1/integrity/sanctions med since/jurisdiction-filter, player_pseudo_id, ed25519-signerat _meta

  ✅ PL-T215

• F14.17.01 Shipped

  Self-service-applicering — POST /developer/data-products/subscriptions med per-product required fields (regulator-jurisdiction för integrity, ethics-committee-approval för research); pending_review-default

  ✅ PL-T215
• F14.17.02 Shipped

  Admin review-queue — GET /admin/applications med tabbar för status, side-drawer-detaljvy, FIFO-sortering, internal-notes (admin-only); POST .../approve

  reject|revoke med audit-trail | ✅ PL-T215
• F14.17.03 Shipped

  Tier-scopade subscriptions — 4 data products × 4 tiers (free/standard/partner/enterprise) med scope-injection vid approve (scopes_granted adderas till DeveloperApiKey.allowed_scopes)

  ✅ PL-T215
• F14.17.04 Shipped

  Subscription-lifecycle — pending_review → approved → revoked

  expired; auto-expiry vid valid_through; revoke med future effective_at för compliance grace period | ✅ PL-T215
• F14.17.05 Shipped

  API version lifecycle management — admin /api/versions-vy med experimental → stable → deprecated → sunset transitions; minst 12 mån deprecation-fönster; force-sunset kräver typed confirmation

  ✅ PL-T215