feat(emails): document email template and campaign folder endpoints by nitishjha64 · Pull Request #349 · GoHighLevel/highlevel-api-docs

nitishjha64 · 2026-10-26T14:00:05Z

Closes #348.

What changed

apps/v3/emails-v3.json only. The change is additive; nothing is removed or retyped.

Change	Detail
+ `GET /emails/locations/{locationId}/templates/folders`	`list-email-template-folders`, scope `emails/templates.readonly`
+ `GET /emails/locations/{locationId}/campaigns/folders`	`list-email-campaign-folders`, scope `emails/campaigns.readonly`
+ `POST /emails/locations/{locationId}/campaigns/folders`	`create-email-campaign-folder`, scope `emails/campaigns.write`, returns 201
`list-email-campaigns`	new query param `folderId` (`<id>` or `root`)
`list-email-templates`	`include` description now points to `/templates/folders` for folders
New schemas	`EmailFolderPublicDto`, `EmailFoldersPagePublicDto`, `ListEmailFoldersPublicResponseDto`, `CreateEmailFolderPublicBodyDto`
`parentFolderId`	added to `EmailCampaignPublicV2Dto`, create/update/get campaign responses (`GetEmailCampaignPublicV2ResponseDto`), and `CreateTemplateFolderPublicV2BodyDto`

Folder list response: { data: [{ id, name, parentFolderId, childCount, archived }], page: { limit, offset, total, hasMore } }.

How it was produced

The spec is generated from the emails service (leadgen-marketplace-backend) on branch feat/email-folders-public-api. Only that branch's delta over master was applied to this file. Unrelated drift and the /emails/placeholder/default.png route that a full regeneration would bring in were left out. A semantic diff confirms the 13 changed operations and schemas match the generated delta exactly.

The new operations reference ../common/common-schemas.json for 400/401/422, the same as the existing operations in this file.

Merge order

Draft until the backend ships. Merge this after both of these are deployed:

the leadgen-marketplace-backend emails change
the platform-backend IAM urlScopeMap entries

Otherwise the docs describe endpoints that return 404 or 403.

🤖 Generated with Claude Code

https://claude.ai/code/session_015GVn1rpdxBqsujrA4ruFiN

Adds GET /emails/locations/{locationId}/templates/folders, GET and POST /emails/locations/{locationId}/campaigns/folders, the folderId filter on list-email-campaigns, and parentFolderId on campaign responses and the template folder create body. Refs #348 Claude-Session: https://claude.ai/code/session_015GVn1rpdxBqsujrA4ruFiN Co-Authored-By: AW <273421570+ghl-aw@users.noreply.github.com>

orca-security-us · 2026-10-26T14:01:24Z

+            }
+          }
+        ],
+        "responses": {


🟡 [LOW] Response Code Missing (v3)

Details:
OpenAPI operations lack standard HTTP response codes for error handling and
security scenarios. Missing response definitions prevent proper API
documentation, client error handling, and security response patterns. Define
appropriate response codes for each operation type based on HTTP standards and
security requirements.

Recommendation:
429 response should be set

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-10-26T14:01:24Z

+            }
+          }
+        },
+        "responses": {


🟡 [LOW] Response Code Missing (v3)

Details:
OpenAPI operations lack standard HTTP response codes for error handling and
security scenarios. Missing response definitions prevent proper API
documentation, client error handling, and security response patterns. Define
appropriate response codes for each operation type based on HTTP standards and
security requirements.

Recommendation:
500 response should be set

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-10-26T14:01:24Z

+            }
+          }
+        ],
+        "responses": {


🟡 [LOW] Response Code Missing (v3)

Details:
OpenAPI operations lack standard HTTP response codes for error handling and
security scenarios. Missing response definitions prevent proper API
documentation, client error handling, and security response patterns. Define
appropriate response codes for each operation type based on HTTP standards and
security requirements.

Recommendation:
500 response should be set

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

code-quality-gates · 2026-10-26T14:01:25Z

Quality Gate Results

⚠️ 1 Warning(s) — non-blocking, please review
✅ 6 Passed

⚠️ Warnings (non-blocking — worth reviewing)

dependency_license_check (1 item) — detailed results (inline comments only on changed lines) · 📖 docs

🔍 View detailed quality gate results

orca-security-us

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0 0 4 145	View in Orca
Passed	SAST	0 0 0 0	View in Orca
Passed	Secrets	0 0 0 0	View in Orca
Passed	Vulnerabilities	0 0 0 0	View in Orca

🛡️ The following IaC misconfigurations have been detected

	NAME	FILE
	Response Code Missing (v3)	...ps/v3/emails-v3.json	View in code
	Response Code Missing (v3)	...ps/v3/emails-v3.json	View in code
	Response Code Missing (v3)	...ps/v3/emails-v3.json	View in code
	Response on operations that should have a body has undefined schema	...ps/v3/emails-v3.json	View in code
	Empty Array	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...ps/v3/emails-v3.json	View in code
...	...	...	...

…dpoints Claude-Session: https://claude.ai/code/session_015GVn1rpdxBqsujrA4ruFiN Co-Authored-By: AW <273421570+ghl-aw@users.noreply.github.com>

Claude-Session: https://claude.ai/code/session_015GVn1rpdxBqsujrA4ruFiN Co-Authored-By: AW <273421570+ghl-aw@users.noreply.github.com>

`name` up to 255, `search` up to 100 and `parentFolderId` up to 64 characters, matching the emails service validation. Claude-Session: https://claude.ai/code/session_015GVn1rpdxBqsujrA4ruFiN Co-Authored-By: AW <273421570+ghl-aw@users.noreply.github.com>

…outes Mirrors leadgen-marketplace-backend#13146 (5a86505): list-email-template-folders, list-email-campaign-folders and create-email-campaign-folder now declare 429. Applied from the generated spec; only those three entries change. Claude-Session: https://claude.ai/code/session_015GVn1rpdxBqsujrA4ruFiN Co-Authored-By: AW <273421570+ghl-aw@users.noreply.github.com>

orca-security-us · 2026-11-03T09:53:28Z

+            "description": "Too many requests - Rate limit exceeded"
+          }
+        },
+        "tags": [


⚪️ [INFO] Object Without Required Property

Details:
OpenAPI v3 specification objects lack required fields defined by the standard,
causing schema validation failures and potential client integration issues.
Missing required properties prevent proper API documentation parsing and code
generation. Include all mandatory fields as specified in the OpenAPI 3.0
specification.

Recommendation:
tags has all required fields

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:53:29Z

+            "description": "Too many requests - Rate limit exceeded"
+          }
+        },
+        "tags": [


⚪️ [INFO] Object Without Required Property

Details:
OpenAPI v3 specification objects lack required fields defined by the standard,
causing schema validation failures and potential client integration issues.
Missing required properties prevent proper API documentation parsing and code
generation. Include all mandatory fields as specified in the OpenAPI 3.0
specification.

Recommendation:
tags has all required fields

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:53:29Z

+            "description": "Too many requests - Rate limit exceeded"
+          }
+        },
+        "tags": [


⚪️ [INFO] Object Without Required Property

Details:
OpenAPI v3 specification objects lack required fields defined by the standard,
causing schema validation failures and potential client integration issues.
Missing required properties prevent proper API documentation parsing and code
generation. Include all mandatory fields as specified in the OpenAPI 3.0
specification.

Recommendation:
tags has all required fields

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:53:29Z

+        ]
      }
    },
    "/emails/locations/{locationId}/templates/{templateId}": {


⚪️ [INFO] Path Is Ambiguous

Details:
OpenAPI specifications contain ambiguous paths where different path strings
resolve to the same endpoint after parameter substitution. This creates routing
conflicts and unpredictable API behavior. Consolidate duplicate paths into a
single Path Object containing all operations.

Recommendation:
There shouldn't be ambiguous path

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:53:29Z

+        ],
+        "security": [
+          {
+            "Location-Access": [


⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Location-Access' has no scopes defined for security scheme of type
'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:53:31Z

apps/v3/emails-v3.json:2525

⚪️ [INFO] Path Is Ambiguous

Details:
OpenAPI specifications contain ambiguous paths where different path strings
resolve to the same endpoint after parameter substitution. This creates routing
conflicts and unpredictable API behavior. Consolidate duplicate paths into a
single Path Object containing all operations.

Recommendation:
There shouldn't be ambiguous path

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:53:34Z

apps/v3/emails-v3.json:2232

⚪️ [INFO] Path Is Ambiguous

Details:
OpenAPI specifications contain ambiguous paths where different path strings
resolve to the same endpoint after parameter substitution. This creates routing
conflicts and unpredictable API behavior. Consolidate duplicate paths into a
single Path Object containing all operations.

Recommendation:
There shouldn't be ambiguous path

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:53:37Z

apps/v3/emails-v3.json:1049

⚪️ [INFO] Path Is Ambiguous

Details:
OpenAPI specifications contain ambiguous paths where different path strings
resolve to the same endpoint after parameter substitution. This creates routing
conflicts and unpredictable API behavior. Consolidate duplicate paths into a
single Path Object containing all operations.

Recommendation:
There shouldn't be ambiguous path

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:53:40Z

apps/v3/emails-v3.json:1726

⚪️ [INFO] Path Is Ambiguous

Details:
OpenAPI specifications contain ambiguous paths where different path strings
resolve to the same endpoint after parameter substitution. This creates routing
conflicts and unpredictable API behavior. Consolidate duplicate paths into a
single Path Object containing all operations.

Recommendation:
There shouldn't be ambiguous path

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:53:43Z

apps/v3/emails-v3.json:2070

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Location-Access' has no scopes defined for security scheme of type
'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:53:46Z

apps/v3/emails-v3.json:316

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Location-Access' has no scopes defined for security scheme of type
'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:53:49Z

apps/v3/emails-v3.json:1182

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Location-Access' has no scopes defined for security scheme of type
'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:53:52Z

apps/v3/emails-v3.json:2761

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Location-Access' has no scopes defined for security scheme of type
'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:53:55Z

apps/v3/emails-v3.json:2225

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Location-Access' has no scopes defined for security scheme of type
'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:53:58Z

apps/v3/emails-v3.json:1844

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Location-Access' has no scopes defined for security scheme of type
'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:54:01Z

apps/v3/emails-v3.json:806

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Location-Access' has no scopes defined for security scheme of type
'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-03T09:54:04Z

apps/v3/emails-v3.json:112

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Location-Access' has no scopes defined for security scheme of type
'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0 0 3 108	View in Orca
Passed	SAST	0 0 0 0	View in Orca
Passed	Secrets	0 0 0 0	View in Orca
Passed	Vulnerabilities	0 0 0 0	View in Orca

🛡️ The following IaC misconfigurations have been detected

	NAME	FILE
	Response Code Missing (v3)	...ps/v3/emails-v3.json	View in code
	Response Code Missing (v3)	...ps/v3/emails-v3.json	View in code
	Response Code Missing (v3)	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
	Template Path With No Corresponding Path Parameter	...ps/v3/emails-v3.json	View in code
...	...	...	...

The emails service no longer documents 429 on these routes until the rate-limit follow-up lands (leadgen-marketplace-backend#13146). Reverts 787174e. Claude-Session: https://claude.ai/code/session_015GVn1rpdxBqsujrA4ruFiN Co-Authored-By: AW <273421570+ghl-aw@users.noreply.github.com>

get-email-campaign now returns parentFolderId, like list, create and update (GoHighLevel/leadgen-marketplace-backend#13146). Only the GetEmailCampaignPublicV2ResponseDto schema changes; the entry is taken from the swagger generator output for the campaigns controller. Claude-Session: https://claude.ai/code/session_015GVn1rpdxBqsujrA4ruFiN Co-Authored-By: AW <273421570+ghl-aw@users.noreply.github.com>