Introduction

This API gives you access to all the features of Emehmon Sync programmatically.

This documentation aims to provide all the information you need to work with our API.

**Xizmat Safari (XF) API** — отдельный сервис (бронирование госкомандировок, интеграция МВД ↔ E-mehmon) со своей документацией: https://sandbox-api.emehmon.uz/sandbox/xf/docs

## Authentication (HMAC)
Every request must include these headers:
    - `X-User-Name`: API username
    - `X-User-Ts`: Unix timestamp (seconds)
    - `X-User-Request-Id`: UUID (required, unique)
    - `X-User-Hash`: hex HMAC-SHA256 signature

Signature formula:
`X-User-Hash = HMAC_SHA256( X-User-Name + X-User-Ts + X-User-Request-Id, secret )`

Notes:
- TTL is 5 minutes (server rejects old timestamps)
- Replay protection is enabled using `(username, timestamp, request_id)`

---

## Response format

### Success
```json
{
    "code": 200,
    "message": "success",
    "data": {},
    "request_id": "uuid"
}

## Error
```json
{
  "code": 401,
  "message": "Request time expired",
  "error_code": "REQUEST_TIME_EXPIRED",
  "meta": {},
  "request_id": "uuid"
}
```
"meta" may contain validation details (e.g. { "field": "date" }).

## Errors
| HTTP | error_code             | When                                            |
| ---: | ---------------------- | ----------------------------------------------- |
|  401 | `MISSING_AUTH_HEADERS` | Required auth headers are missing               |
|  401 | `INVALID_TIMESTAMP`    | `X-User-Ts` is not numeric                      |
|  401 | `REQUEST_TIME_EXPIRED` | Timestamp is outside TTL window                 |
|  401 | `INVALID_REQUEST_ID`   | `X-User-Request-Id` is invalid format           |
|  403 | `USER_NOT_FOUND`       | Username not found or inactive                  |
|  403 | `IP_NOT_ALLOWED`       | Client IP not in `allowed_ips` (if enabled)     |
|  403 | `REPLAY_DETECTED`      | Duplicate `(username, timestamp, request_id)`   |
|  403 | `INVALID_SIGNATURE`    | `X-User-Hash` does not match expected signature |
|  403 | `ACCESS_DENIED`        | User has no permission for this action          |
|  422 | `VALIDATION_ERROR`     | Request body validation failed                  |
|  500 | `INTERNAL_ERROR`       | Unhandled server error                          |

Authenticating requests

This API is not authenticated.