> ## Documentation Index > Fetch the complete documentation index at: https://developer.mogl.online/llms.txt > Use this file to discover all available pages before exploring further. # Generate an idempotent registered scenario > Creates the bounded scenario state after revalidating actors and options. application.applied creates one active standard-visibility QA job, three shared future deliverables, and one independent applied mapping per selected athlete. It does not require the brand's private-job feature, hire athletes, sign athlete agreements, assign hired-only deliverables, or create Deal Folders. Retrying the same administrator-owned idempotency key and request returns the existing run. ## OpenAPI ````yaml /storage/api-docs/api-docs.json post /internal/qa-scenario-lab/runs openapi: 3.0.0 info: title: MOGL Core API description: >- MOGL Platform Core API — powering athlete NIL deals, brand partnerships, agent management, payments, messaging, and more. * * ## Authentication * - **JWT Bearer Token**: Most endpoints require a Bearer token obtained via `/api/login`. * - **Server-to-Server API Key**: Internal/lambda/cron endpoints use an `X-API-KEY` header. * * ## Rate Limiting * - Registration & login endpoints: 4–15 requests per minute * - Public/influencer endpoints: 200 requests per minute * - Authenticated endpoints: standard Laravel throttle version: 1.0.0 servers: - url: http://localhost/mogl/mogl-backend/api description: Local - url: https://dev-api.mogl.online/api description: Dev - url: https://staging-api.mogl.online/api description: Staging - url: https://api.mogl.online/api description: Production security: - bearerAuth: [] tags: - name: Authentication description: Login, registration, password reset - name: User Registration - Common description: Common user registration & email check - name: User Registration - Athlete description: Athlete registration & onboarding steps - name: User Registration - Partner description: Partner/Brand registration & onboarding steps - name: User Registration - Agent description: Agent registration & onboarding steps - name: User Registration - Fan description: Fan registration & onboarding steps - name: User Profile description: User profile management, settings, social media - name: Athlete description: 'Athlete-specific endpoints: search, details, availability' - name: Athlete - Availability Confirmation description: Post-hiring availability confirmation workflow - name: Athlete - NIL Feed description: Athlete NIL feed and partner search - name: Athlete - AI Assistant description: >- AI-powered job assistant for athletes — chat, conversation history, read state, and clarification drafts - name: Athlete - AI Waitlist description: AI Athlete Assistant waitlist status, social proof, and joining - name: Partner description: Partner/Brand-specific endpoints - name: Partner - External Job description: External job link & applicant management - name: Partner - Deliverable Report description: Deliverable detail reports for brands - name: Partner - Screening Questions description: Screening question reports - name: Partner - Contract Management description: Brand contract management with athletes - name: Partner - Content Library description: Brand content library for deliverable assets - name: Agent description: Agent profile, athlete management, contracts - name: Agent - Athletes description: Agent-athlete relationship management - name: Agent - Stripe description: Agent payment methods & billing via Stripe - name: Agent - Pay description: 'Agent-wide payout feed: money MOGL sends the agent through Stripe Express' - name: Agent - Contracts description: Agent athlete contract management - name: Agent - Availability Confirmation description: Agent managing athlete job availability - name: Agent - Roster Import description: >- CSV client list import through CSVBox (ENG-1619 / ENG-1702): session, CSVBox webhook, progress, row results, retry - name: Agent - Roster Pages description: >- ENG-1685: My Roster Link, public roster directory, public roster page, and roster SEO URL resolution. A roster is the agent's current linked athletes; nothing is stored separately. - name: Jobs description: Job/deal CRUD, search, invitations, hiring, deliverables - name: Deals description: Deal listing, my deals, bulk operations - name: Deal Folder description: >- Deal folder file workflow — uploads, replacements, approvals, revisions, comments. Accessible by athlete, partner/brand, agent, and iOS clients (per-action authorisation enforced server-side). - name: Deal Folder iOS API description: >- iOS-only direct-to-S3 multipart upload endpoints for deal folder files (initiate/complete for new uploads and replacements). Web clients should use the standard `Deal Folder` upload/replace endpoints instead. - name: Chat description: Messaging, chat contacts, notifications - name: Notifications description: Notification preferences, in-app notifications - name: Payments description: Stripe payments, payment history, cards, bulk pay - name: Subscription description: Brand subscription plans & management - name: Public Pages description: Public content endpoints (no auth required) - name: Public - Influencer/SEO description: Public influencer discovery, sitemaps, directories - name: Services description: Athlete service marketplace - name: iOS Device description: iOS device tokens, live activities - name: Onboarding Tutorial description: Onboarding tutorial progress - name: MOGL Rosters description: Roster management & display - name: Internal / Cron description: Server-to-server and cron job endpoints - name: Internal / AI Assistant Tools description: >- Server-to-server Athlete Assistant tool gateway used by mogl-ai-service. Eight Laravel tools share POST /internal/ai-assistant/tools/{tool}. search_kb is Python-local and is not in this path enum. - name: Internal / QA Scenario Lab description: >- Feature-flagged DEV/STAGING-only endpoints called by the authorized Back Office QA Scenario Lab. - name: Affiliate description: Athlete affiliate links & tracking - name: Internal description: Internal - name: Public - Social Linking description: Public - Social Linking paths: /internal/qa-scenario-lab/runs: post: tags: - Internal / QA Scenario Lab summary: Generate an idempotent registered scenario description: >- Creates the bounded scenario state after revalidating actors and options. application.applied creates one active standard-visibility QA job, three shared future deliverables, and one independent applied mapping per selected athlete. It does not require the brand's private-job feature, hire athletes, sign athlete agreements, assign hired-only deliverables, or create Deal Folders. Retrying the same administrator-owned idempotency key and request returns the existing run. operationId: generateQaScenarioLabRun parameters: - $ref: '#/components/parameters/QaScenarioLabApiKey' - $ref: '#/components/parameters/QaScenarioLabAdminId' - $ref: '#/components/parameters/QaScenarioLabTimestamp' - $ref: '#/components/parameters/QaScenarioLabNonce' - $ref: '#/components/parameters/QaScenarioLabPermission' - $ref: '#/components/parameters/QaScenarioLabSignature' requestBody: required: true content: application/json: schema: required: - scenario_key - scenario_version - idempotency_key - brand_id - athlete_ids properties: scenario_key: type: string example: application.applied scenario_version: type: integer minimum: 1 example: 1 idempotency_key: type: string format: uuid brand_id: type: integer minimum: 1 example: 1001 athlete_ids: type: array items: type: integer minimum: 1 maxItems: 50 minItems: 1 uniqueItems: true example: - 2001 - 2002 options: maxProperties: 25 type: object additionalProperties: true initiator_ip: description: >- Original Back Office administrator IP, supplied by the signed dashboard proxy for agreement audit fields. type: string format: ip reference_time: description: >- Optional stable UTC-Z clock included in the idempotency fingerprint. Accepted only through this non-production endpoint. type: string format: date-time pattern: Z$ example: '2026-11-01T12:00:00Z' type: object additionalProperties: false responses: '200': description: The created run, or the existing run for an idempotent retry. content: application/json: schema: required: - data properties: data: $ref: '#/components/schemas/QaScenarioLabRun' type: object '401': description: Missing, invalid, or expired credentials. content: application/json: schema: $ref: '#/components/schemas/UnauthorizedResponse' '409': description: Signed nonce reuse or conflicting idempotency-key reuse. '422': description: Invalid actors, options, scenario, or request. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' security: - serverToServerApiKey: [] qaScenarioLabSignature: [] components: parameters: QaScenarioLabApiKey: name: X-API-KEY in: header description: Dedicated QA Scenario Lab service credential. required: true schema: type: string QaScenarioLabAdminId: name: X-QA-Lab-Admin-Id in: header description: >- Positive initiating Back Office administrator ID included in the signature. required: true schema: type: integer minimum: 1 example: 42 QaScenarioLabTimestamp: name: X-QA-Lab-Timestamp in: header description: Ten-digit Unix timestamp. Default maximum age is 300 seconds. required: true schema: type: integer format: int64 example: 1791194024 QaScenarioLabNonce: name: X-QA-Lab-Nonce in: header description: One-use UUID included in the signature. required: true schema: type: string format: uuid QaScenarioLabPermission: name: X-QA-Lab-Permission in: header description: Signed permission claim. required: true schema: type: string enum: - qa_scenario_lab QaScenarioLabSignature: name: X-QA-Lab-Signature in: header description: Lowercase hexadecimal HMAC-SHA256 of the canonical request envelope. required: true schema: type: string maxLength: 64 minLength: 64 pattern: ^[a-f0-9]{64}$ schemas: QaScenarioLabRun: required: - id - scenario_key - scenario_version - status - brand_id - athlete_ids - athlete_results - symbolic_references - available_triggers - cleanup_available - entities - pre_execution_capture properties: id: type: string format: uuid scenario_key: type: string example: application.applied scenario_version: type: integer minimum: 1 example: 1 status: type: string enum: - pending - running - succeeded - partially_succeeded - failed - cleaned brand_id: type: integer minimum: 1 athlete_ids: type: array items: type: integer minimum: 1 athlete_results: type: object additionalProperties: true reference_time: description: Stable UTC reference time used to build this run. type: string format: date-time nullable: true expected_state: type: object nullable: true additionalProperties: true symbolic_references: description: >- Stable symbolic aliases mapped to fresh run-owned IDs or bounded public values. type: object additionalProperties: true result: type: object nullable: true additionalProperties: true error_code: type: string nullable: true available_triggers: type: array items: $ref: '#/components/schemas/QaScenarioLabTrigger' cleanup_available: description: >- True only when per-run cleanup is allowed by the authoritative backend environment. type: boolean entities: type: array items: required: - entity_type - entity_id - ownership properties: athlete_id: type: integer nullable: true entity_type: type: string entity_id: type: string ownership: type: string enum: - created - referenced type: object pre_execution_capture: $ref: '#/components/schemas/QaScenarioLabCapture' type: object UnauthorizedResponse: properties: message: type: string example: Unauthenticated. type: object ValidationErrorResponse: properties: message: type: string example: The given data was invalid. errors: type: object additionalProperties: type: array items: type: string type: object QaScenarioLabTrigger: required: - key - version - display_name - one_shot properties: key: type: string example: availability.confirm version: type: integer minimum: 1 example: 1 display_name: type: string example: Confirm availability one_shot: type: boolean example: true type: object QaScenarioLabCapture: required: - snapshot_ref - sha256 - state properties: snapshot_ref: type: string pattern: ^[a-z][a-z0-9_]*$ sha256: type: string maxLength: 64 minLength: 64 pattern: ^[a-f0-9]{64}$ state: description: >- Bounded explicit-field-allowlist snapshot of selected run-owned state, Assistant gates, source context, and versions. For evaluation-correlated scenarios, facts.portfolios carries the athlete's current portfolio summary_counts and portfolio_group_counts, and facts.file_versions and facts.file_comments carry the run-created Deal Folder file versions and comments (including comment_type and active_version_id). Secrets and unrelated private account fields are excluded. type: object additionalProperties: true type: object securitySchemes: bearerAuth: type: http description: >- JWT Bearer token authentication. Use the /api/login endpoint to obtain a token. scheme: bearer bearerFormat: JWT serverToServerApiKey: type: apiKey description: Server-to-Server API Key for internal/lambda/cron calls name: X-API-KEY in: header qaScenarioLabSignature: type: apiKey description: >- HMAC-SHA256 signature for a one-use, short-lived Back Office administrator envelope. Used together with the dedicated X-API-KEY credential and the signed administrator, timestamp, nonce, and permission headers. name: X-QA-Lab-Signature in: header ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.