# Final POS Public API

Endpoints that do not require authentication — health checks, status probes, and other public-facing operations.

> **Format**
> - **Base path:** `/v1/public/...`
> - **Auth:** none. Do not send `x-api-key` or `x-org-api-key`.
> - **Content type:** `application/json`

License: UNLICENSED

## Servers

Official API
```
https://api.finalpos.com
```

## Security

### X-Api-Key

API Key for authentication

Type: apiKey
In: header
Name: x-api-key

### X-Org-Api-Key

Organization API key

Type: apiKey
In: header
Name: x-org-api-key

## Download OpenAPI description

[Final POS Public API](https://docs.finalpos.com/_bundle/openapi-public.yaml)

## Public

### Liveness check

 - [GET /v1/public/health](https://docs.finalpos.com/openapi-public/public/healthcontroller_check.md): Returns { status: "ok" } when the service is up. Publicly accessible — no API key required. Intended for uptime monitors and load-balancer health probes.

### Resolve the calling company identity

 - [GET /v1/whoami](https://docs.finalpos.com/openapi-public/public/whoamicontroller_whoami.md): Returns the company identity and key status resolved from the x-api-key. Intended as a login gate for internal tooling: pass a company private API key (sk_...) and confirm which company, currency, and key it maps to. Read-only. The key must be a company key — an organization key (x-org-api-key) is rejected.

### List published extensions

 - [GET /v1/public/published-extensions](https://docs.finalpos.com/openapi-public/public/listpublishedextensions.md): Returns every extension with status: "public", enriched with its owning organization (logo, name, and organization_alias). Publicly accessible — no API key required. Results are ordered by organization name, then extension name. All query params are optional; when none are supplied, every public extension is returned (unbounded).

### Get a published extension

 - [GET /v1/public/published-extension/{extensionId}](https://docs.finalpos.com/openapi-public/public/getpublishedextension.md): Returns a single extension with status: "public" by id, including its resolved surfaces and owning organization. Publicly accessible — no API key required. Responds 404 if the extension does not exist or is not public.