Al Maida ERP APIAPI Reference · vv1

Al Maida ERP API — API reference

Multi-tenant ERP for Al Maida joinery & fit-out. Every endpoint below is served under one host; authentication is a bearer token obtained from the login endpoint. This page is generated directly from the live OpenAPI document, so it always matches the running API.

282
Endpoints
86
Modules
304
Schemas
vv1
Version

How to use this API

Base URL

All paths are relative to the API host. In local development the UI proxies /api to the backend, so calls stay same-origin.

http://localhost:5101

Authenticate

Post credentials to get an access token (JWT). Send it as a bearer header on every other call. A refresh cookie is set automatically.

POST /api/v1/auth/login
{ "email": "...", "password": "..." }

→ { "accessToken": "eyJ…", "companyId": "…", … }
Authorize requests

Attach the token to every request:

Authorization: Bearer <accessToken>

The token carries your company and roles — there is no separate tenant header.

Refresh & sign out

On a 401, call POST /api/v1/auth/refresh (uses the cookie) to get a new token, then retry. POST /api/v1/auth/logout ends the session.

Errors

401 not signed in · 403 lacks permission · 404 not found · 409 conflict · 422 a rule refused the write (nothing is saved).

Reading an endpoint

Each card shows the method, path, and what it does. Expand Parameters, body & responses for the exact fields — * marks required ones.

AdminCompanies

1 endpoint
POST /api/v1/admin/companies
Parameters, body & responses
Parameters
NameInTypeDescription
X-Platform-Key header string
Request body application/json
FieldTypeDescription
name string?
legalName string?
adminEmail string?
adminFullName string?
adminPassword string?
Responses
StatusMeaningBody
200OKProvisionResult
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Appraisals

3 endpoints
POST /api/v1/appraisals
Parameters, body & responses
Request body application/json
FieldTypeDescription
employeeId string · uuid
period string?
rating integer · int32
comments string?
Responses
StatusMeaningBody
200OKCreatedAppraisalResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/appraisals/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKAppraisalDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
GET /api/v1/appraisals/employee/{employeeId}
Parameters, body & responses
Parameters
NameInTypeDescription
employeeId* path string · uuid
Responses
StatusMeaningBody
200OKAppraisalDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

ApprovalMatrices

2 endpoints
GET /api/v1/admin/approval-matrices
Parameters, body & responses
Responses
StatusMeaningBody
200OKApprovalMatrixDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
PUT /api/v1/admin/approval-matrices/{documentType}

Create or fully replace the matrix + levels for a document type.

Parameters, body & responses
Parameters
NameInTypeDescription
documentType* path string
Request body application/json
FieldTypeDescription
isActive boolean
levels ApprovalLevelInput[]?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Approvals

3 endpoints
GET /api/v1/approvals

Requests pending THIS user's action (holds the current level's approver role, didn't raise it).

Parameters, body & responses
Responses
StatusMeaningBody
200OKPendingApproval[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/approvals/{id}/approve

Approve at the current level. The engine rejects (422) an ineligible actor or the raiser.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
comment string?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/approvals/{id}/reject

Reject at the current level. The engine rejects (422) an ineligible actor or the raiser.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
comment string?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

ApprovalsAdmin

2 endpoints
GET /api/v1/admin/approvals

Every pending approval in the company: what it waits on, since when, and whether it is stranded.

Parameters, body & responses
Responses
StatusMeaningBody
200OKInFlightApproval[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/admin/approvals/{id}/override

Break-glass: approve a pending request past its remaining levels with a logged reason (§13.2). The engine re-checks the permission and raiser ≠ overrider, and it works even on a stranded document (it does not read the — possibly deleted — current level). 422 on an empty reason or the raiser.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
reason string?
Responses
StatusMeaningBody
204No Content—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails

Attendance

3 endpoints
GET /api/v1/attendance/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKAttendanceDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/attendance/{id}/clock-out
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/attendance/clock-in
Parameters, body & responses
Request body application/json
FieldTypeDescription
employeeId string · uuid
siteId string · uuid
Responses
StatusMeaningBody
200OKClockedIn
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Audit

1 endpoint
GET /api/v1/audit

Audit entries for the active company, newest first — paged and filterable.

Parameters, body & responses
Parameters
NameInTypeDescription
entityType query string
action query string
userId query string · uuid
from query string · date-time
to query string · date-time
page query integer · int32
pageSize query integer · int32
Responses
StatusMeaningBody
200OKAuditEntry[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

Auth

5 endpoints
POST /api/v1/auth/change-password
Parameters, body & responses
Request body application/json
FieldTypeDescription
currentPassword string?
newPassword string?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/auth/login
Parameters, body & responses
Request body application/json
FieldTypeDescription
email string?
password string?
companyId string · uuid?
Responses
StatusMeaningBody
200OKAuthResponse
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/auth/logout
Parameters, body & responses
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/auth/refresh
Parameters, body & responses
Responses
StatusMeaningBody
200OKAuthResponse
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/auth/switch-company
Parameters, body & responses
Request body application/json
FieldTypeDescription
companyId string · uuid
Responses
StatusMeaningBody
200OKAuthResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Bids

3 endpoints
POST /api/v1/bids
Parameters, body & responses
Request body application/json
FieldTypeDescription
rfqId string · uuid
supplierId string · uuid
unitPrice number · double
leadTimeDays integer · int32
terms string?
lines BidLineInput[]?
Responses
StatusMeaningBody
200OKCreatedBidResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/bids/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKBidDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/bids/award

Award one bid — refused if it is not the lowest and no justification is given.

Parameters, body & responses
Request body application/json
FieldTypeDescription
rfqId string · uuid
bidId string · uuid
justification string?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Capas

4 endpoints
POST /api/v1/capas
Parameters, body & responses
Request body application/json
FieldTypeDescription
ncrId string · uuid?
actionType string?
description string?
Responses
StatusMeaningBody
200OKCreatedCapaResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/capas/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKCapaDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/capas/{id}/close
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKCapaDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/capas/{id}/verify
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
note string?
Responses
StatusMeaningBody
200OKCapaDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

CashAdvances

4 endpoints
POST /api/v1/cash-advances
Parameters, body & responses
Request body application/json
FieldTypeDescription
amount number · double
purpose string?
Responses
StatusMeaningBody
200OKCreatedCashAdvanceResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/cash-advances/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKCashAdvanceDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/cash-advances/{id}/close

Close — requires the receipt image and the inspection flag.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
receiptImageRef string?
inspected boolean
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/cash-advances/{id}/disburse

Disburse — refused if the custodian is the requester (§7.3).

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Catalog

6 endpoints
GET /api/v1/catalog/nodes

List nodes, optionally filtered by parent and/or level.

Parameters, body & responses
Parameters
NameInTypeDescription
parentId query string · uuid
level query string
includeInactive query boolean
Responses
StatusMeaningBody
200OKCatalogNodeDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/catalog/nodes

Create a catalog node (optionally under a parent).

Parameters, body & responses
Request body application/json
FieldTypeDescription
parentId string · uuid?
level string?
name string?
uom string?
Responses
StatusMeaningBody
201Created—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails
PUT /api/v1/catalog/nodes/{id}

Rename / re-UoM / (de)activate a node.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
name string?
uom string?
isActive boolean
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/catalog/nodes/{id}/rate

The rate effective at asOf (default today). 404 unknown node, 422 no rate — no parent fallback.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
asOf query string · date
Responses
StatusMeaningBody
200OKResolvedRateDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not FoundProblemDetails
422Unprocessable ContentProblemDetails
GET /api/v1/catalog/rates

A node's rates, optionally those covering a given date; newest-effective first.

Parameters, body & responses
Parameters
NameInTypeDescription
nodeId query string · uuid
effectiveOn query string · date
Responses
StatusMeaningBody
200OKRateCardDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/catalog/rates

Add a time-bounded rate to a node.

Parameters, body & responses
Request body application/json
FieldTypeDescription
catalogNodeId string · uuid
unitCost number · double
uom string?
effectiveFrom string · date
effectiveTo string · date?
sourceType string?
sourceRef string?
supplierId string · uuid?
Responses
StatusMeaningBody
201Created—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails

Competencies

3 endpoints
POST /api/v1/competencies
Parameters, body & responses
Request body application/json
FieldTypeDescription
employeeId string · uuid
code string?
validFrom string · date-time
validTo string · date-time?
Responses
StatusMeaningBody
200OKCreatedCompetencyResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/competencies/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKCompetencyDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
GET /api/v1/competencies/employee/{employeeId}
Parameters, body & responses
Parameters
NameInTypeDescription
employeeId* path string · uuid
Responses
StatusMeaningBody
200OKCompetencyDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

ComplianceObligations

3 endpoints
GET /api/v1/environment/obligations
Parameters, body & responses
Parameters
NameInTypeDescription
search query string
page query integer · int32
pageSize query integer · int32
Responses
StatusMeaningBody
200OKComplianceObligationDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/environment/obligations
Parameters, body & responses
Request body application/json
FieldTypeDescription
title string?
authority string?
reference string?
validFrom string · date
expiresOn string · date
Responses
StatusMeaningBody
200OKCreatedObligationResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/environment/obligations/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKComplianceObligationDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Consumption

2 endpoints
POST /api/v1/consumption

Book a material consumption — over the allocation requires an explicit variance + reason.

Parameters, body & responses
Request body application/json
FieldTypeDescription
productionOrderId string · uuid
quantity number · double
isVariance boolean
varianceReason string?
Responses
StatusMeaningBody
200OKRecordedConsumptionResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/consumption/{productionOrderId}
Parameters, body & responses
Parameters
NameInTypeDescription
productionOrderId* path string · uuid
Responses
StatusMeaningBody
200OKConsumptionSummaryDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Contracts

3 endpoints
POST /api/v1/contracts
Parameters, body & responses
Request body application/json
FieldTypeDescription
quotationId string · uuid
scope string?
boqRef string?
paymentTerms string?
retentionPct number · double?
warrantyMonths integer · int32?
ldTerms string?
variationClause string?
Responses
StatusMeaningBody
200OKCreatedContractResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/contracts/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKContractDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/contracts/{id}/sign

Sign the contract — gate G1: mints the project number. Concurrency-guarded by rowVersion.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
rowVersion integer · int32
Responses
StatusMeaningBody
200OKSignedContract
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

CostTarget

1 endpoint
GET /api/v1/reports/cost-target/{projectId}
Parameters, body & responses
Parameters
NameInTypeDescription
projectId* path string · uuid
Responses
StatusMeaningBody
200OKCostTargetDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not FoundProblemDetails

CreditNotes

2 endpoints
POST /api/v1/credit-notes
Parameters, body & responses
Request body application/json
FieldTypeDescription
projectId string · uuid
amount number · double
reason string?
Responses
StatusMeaningBody
200OKCreditNoteResult
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/credit-notes/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKCreditNoteDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Customers

7 endpoints
GET /api/v1/customers
Parameters, body & responses
Parameters
NameInTypeDescription
type query string
includeInactive query boolean
search query string
page query integer · int32
pageSize query integer · int32
Responses
StatusMeaningBody
200OKCustomerDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/customers
Parameters, body & responses
Request body application/json
FieldTypeDescription
legalName string?
customerType string?
displayName string?
taxId string?
email string?
phone string?
address string?
country string?
paymentTerms string?
creditLimit number · double?
Responses
StatusMeaningBody
200OKCreatedCustomerResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/customers/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKCustomerDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
PUT /api/v1/customers/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
legalName string?
customerType string?
displayName string?
taxId string?
email string?
phone string?
address string?
country string?
paymentTerms string?
creditLimit number · double?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/customers/{id}/deactivate
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/customers/{id}/profile

The client 360 — the customer plus their lead pipeline, quotation position and AR (one call).

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKCustomerProfileDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not FoundProblemDetails
POST /api/v1/customers/{id}/reactivate
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

CustomerStatements

1 endpoint
GET /api/v1/finance/customers/{customerId}/statement

The customer's statement: per-project contract value, cash received, and outstanding, with totals.

Parameters, body & responses
Parameters
NameInTypeDescription
customerId* path string · uuid
Responses
StatusMeaningBody
200OKCustomerStatementDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not FoundProblemDetails

Dashboard

2 endpoints
GET /api/v1/dashboard/executive
Parameters, body & responses
Responses
StatusMeaningBody
200OKExecutiveSummaryDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
GET /api/v1/dashboard/me

The caller's own role-scoped dashboard — each KPI present only if they hold its view permission.

Parameters, body & responses
Responses
StatusMeaningBody
200OKRoleDashboardDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

DispatchClearance

1 endpoint
GET /api/v1/production-orders/{orderId}/dispatch-clearance
Parameters, body & responses
Parameters
NameInTypeDescription
orderId* path string · uuid
Responses
StatusMeaningBody
200OKDispatchClearance
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

DispatchOrders

6 endpoints
POST /api/v1/dispatch-orders
Parameters, body & responses
Request body application/json
FieldTypeDescription
projectId string · uuid
productionOrderIds string · uuid[]?
Responses
StatusMeaningBody
200OKDispatchedOrder
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/dispatch-orders/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKDispatchOrderDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/dispatch-orders/{id}/checklist
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
description string?
Responses
StatusMeaningBody
200OKCreatedChecklistItem
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/dispatch-orders/{id}/checklist/{itemId}/complete
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
itemId* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/dispatch-orders/{id}/deliver
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
arrivals UnitArrival[]?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/dispatch-orders/{id}/load
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
vehicleId string · uuid
driverId string · uuid
loadedUnitIds string · uuid[]?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Documents

3 endpoints
GET /api/v1/documents
Parameters, body & responses
Parameters
NameInTypeDescription
entityType query string
entityId query string · uuid
Responses
StatusMeaningBody
200OKGeneratedDocumentDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
GET /api/v1/documents/{id}/content
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/documents/generate
Parameters, body & responses
Request body application/json
FieldTypeDescription
templateKey string?
entityId string · uuid
Responses
StatusMeaningBody
200OKGeneratedDocumentDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Drawings

7 endpoints
GET /api/v1/drawings
Parameters, body & responses
Parameters
NameInTypeDescription
contractId query string · uuid
Responses
StatusMeaningBody
200OKDrawingDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/drawings
Parameters, body & responses
Request body application/json
FieldTypeDescription
contractId string · uuid
drawingNumber string?
title string?
discipline string?
Responses
StatusMeaningBody
200OKCreatedDrawingResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/drawings/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKDrawingDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/drawings/{id}/release

Release — gated on review approval; supersedes the prior released revision.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
rowVersion integer · int32
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/drawings/{id}/release-check

The seam production consumes: may work proceed against this drawing revision?

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKReleaseCheckResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/drawings/{id}/revise

Create the next revision (a new row); the prior revision is left immutable.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
title string?
discipline string?
Responses
StatusMeaningBody
200OKCreatedDrawingResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/drawings/{id}/submit

Submit a draft revision for review — routes through the approval engine.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Drivers

2 endpoints
POST /api/v1/drivers
Parameters, body & responses
Request body application/json
FieldTypeDescription
name string?
licenseNumber string?
Responses
StatusMeaningBody
200OKCreatedResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/drivers/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKDriverDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Employees

5 endpoints
GET /api/v1/employees
Parameters, body & responses
Parameters
NameInTypeDescription
includeInactive query boolean
Responses
StatusMeaningBody
200OKEmployeeDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/employees
Parameters, body & responses
Request body application/json
FieldTypeDescription
firstName string?
lastName string?
nationalId string?
contractType string?
joinDate string · date-time
visaNumber string?
visaExpiry string · date-time?
sponsor string?
departmentId string · uuid?
managerId string · uuid?
userId string · uuid?
Responses
StatusMeaningBody
200OKCreatedEmployee
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/employees/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKEmployeeDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/employees/{id}/compensation
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
baseSalary number · double?
allowances number · double?
bankAccount string?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/employees/{id}/deactivate
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

EnvironmentalAspects

3 endpoints
GET /api/v1/environment/aspects
Parameters, body & responses
Parameters
NameInTypeDescription
search query string
significance query string
page query integer · int32
pageSize query integer · int32
Responses
StatusMeaningBody
200OKEnvironmentalAspectDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/environment/aspects
Parameters, body & responses
Request body application/json
FieldTypeDescription
activity string?
aspect string?
impact string?
significance string?
Responses
StatusMeaningBody
200OKCreatedAspectResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/environment/aspects/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKEnvironmentalAspectDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

EnvironmentalIncidents

2 endpoints
POST /api/v1/environment/incidents
Parameters, body & responses
Request body application/json
FieldTypeDescription
projectId string · uuid
category string?
severity string?
title string?
note string?
Responses
StatusMeaningBody
200OKRaisedEnvironmentalIncident
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/environment/incidents/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKEnvironmentalIncidentDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

EnvironmentalInductions

3 endpoints
GET /api/v1/environment/inductions
Parameters, body & responses
Parameters
NameInTypeDescription
search query string
projectId query string · uuid
page query integer · int32
pageSize query integer · int32
Responses
StatusMeaningBody
200OKEnvironmentalInductionDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/environment/inductions
Parameters, body & responses
Request body application/json
FieldTypeDescription
projectId string · uuid
personName string?
isSubcontractor boolean
topic string?
inductedOn string · date
Responses
StatusMeaningBody
200OKRegisteredInductionResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/environment/inductions/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKEnvironmentalInductionDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

EnvironmentalMonitoring

3 endpoints
GET /api/v1/environment/monitoring
Parameters, body & responses
Parameters
NameInTypeDescription
metric query string
from query string · date
to query string · date
page query integer · int32
pageSize query integer · int32
Responses
StatusMeaningBody
200OKEnvironmentalReadingDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/environment/monitoring
Parameters, body & responses
Request body application/json
FieldTypeDescription
metric string?
value number · double
periodStart string · date
periodEnd string · date
machineId string · uuid?
Responses
StatusMeaningBody
200OKRecordedReadingResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/environment/monitoring/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKEnvironmentalReadingDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

EnvironmentalObjectives

1 endpoint
GET /api/v1/environment/objectives
Parameters, body & responses
Parameters
NameInTypeDescription
periodStart query string · date
periodEnd query string · date
Responses
StatusMeaningBody
200OKEnvironmentalObjectivesDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

Estimates

11 endpoints
POST /api/v1/estimates

Create a draft estimate.

Parameters, body & responses
Request body application/json
FieldTypeDescription
quotationId string · uuid?
estimateType string?
overheadPercent number · double
marginPercent number · double
Responses
StatusMeaningBody
201Created—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails
GET /api/v1/estimates/{id}

The estimate with its priced lines and rolled-up totals. The cost basis (unit/line cost, overhead, margin, total cost) is MASKED to null for a caller without `estimates.cost.view` — a price-only reader (e.g. Sales) sees quantities and selling, never the cost behind them.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKEstimateDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not FoundProblemDetails
POST /api/v1/estimates/{id}/approve

Approver signs a verified estimate — it becomes immutable (cannot be the maker or verifier). Verified → Approved.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
204No Content—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails
POST /api/v1/estimates/{id}/lines

Add a catalog line (CatalogNodeId) or a custom line (CustomDescription + CustomUnitCost).

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
catalogNodeId string · uuid?
customDescription string?
quantity number · double
uom string?
customUnitCost number · double?
customCostEvidence string?
Responses
StatusMeaningBody
201Created—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails
PUT /api/v1/estimates/{id}/lines/{lineNo}/evidence

Attach/replace the cost justification on a custom line (draft only). 422 on a catalog line or empty evidence.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
lineNo* path integer · int32
Request body application/json
FieldTypeDescription
evidence string?
Responses
StatusMeaningBody
204No Content—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not FoundProblemDetails
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails
POST /api/v1/estimates/{id}/lines/{lineNo}/price

Run the pricing engine on a line and return the breakdown (422 if the line's node has no rate).

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
lineNo* path integer · int32
Responses
StatusMeaningBody
200OKPricedLineDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not FoundProblemDetails
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails
POST /api/v1/estimates/{id}/lines/{lineNo}/promote

Promote a proven custom line (on an approved estimate) into the catalog as a new node + a 'promoted' rate at the line's unit cost. Needs `catalog.manage` — it writes to the shared catalog. Returns the new node id. 422 on a catalog line, an already-promoted line, or a non-approved estimate.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
lineNo* path integer · int32
Request body application/json
FieldTypeDescription
name string?
level string?
parentId string · uuid?
Responses
StatusMeaningBody
201Created—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not FoundProblemDetails
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails
POST /api/v1/estimates/{id}/lines/import

Bulk-add lines from a BOQ in one atomic call — all land or none do. Returns the new line numbers.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
lines AddEstimateLineInput[]?
Responses
StatusMeaningBody
201Created—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not FoundProblemDetails
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails
POST /api/v1/estimates/{id}/reject

Send a submitted or verified estimate back to the maker for rework. → Draft.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
204No Content—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails
POST /api/v1/estimates/{id}/submit

Maker submits a draft for verification (needs at least one line). Draft → Submitted.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
204No Content—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails
POST /api/v1/estimates/{id}/verify

Verifier signs a submitted estimate (cannot be the maker). Submitted → Verified.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
204No Content—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails

EstimateVsActual

1 endpoint
GET /api/v1/reports/estimate-vs-actual/{projectId}
Parameters, body & responses
Parameters
NameInTypeDescription
projectId* path string · uuid
Responses
StatusMeaningBody
200OKEstimateVsActualDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Gates

2 endpoints
GET /api/v1/admin/gates
Parameters, body & responses
Responses
StatusMeaningBody
200OKGateDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
GET /api/v1/admin/gates/matrices

Approval-matrix configuration health per document type: unconfigured / partial / complete, with the blank levels named (F1-14b). A partial matrix routes documents past its blank levels' approvers, so this is how that silent gap becomes visible.

Parameters, body & responses
Responses
StatusMeaningBody
200OKMatrixConfigDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

GoodsReceipts

2 endpoints
POST /api/v1/goods-receipts
Parameters, body & responses
Request body application/json
FieldTypeDescription
purchaseOrderLineId string · uuid
quantity number · double
Responses
StatusMeaningBody
200OKCreatedGoodsReceiptResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/goods-receipts/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKGoodsReceiptDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Handover

2 endpoints
GET /api/v1/projects/{projectId}/handover
Parameters, body & responses
Parameters
NameInTypeDescription
projectId* path string · uuid
Responses
StatusMeaningBody
200OKHandoverDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/projects/{projectId}/handover
Parameters, body & responses
Parameters
NameInTypeDescription
projectId* path string · uuid
Responses
StatusMeaningBody
200OKHandoverDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

HazardousWaste

3 endpoints
GET /api/v1/environment/hazardous-waste
Parameters, body & responses
Parameters
NameInTypeDescription
wasteStream query string
from query string · date
to query string · date
page query integer · int32
pageSize query integer · int32
Responses
StatusMeaningBody
200OKHazardousWasteDisposalDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/environment/hazardous-waste
Parameters, body & responses
Request body application/json
FieldTypeDescription
wasteStream string?
contractorId string · uuid
manifestNumber string?
quantityKg number · double
disposedOn string · date
Responses
StatusMeaningBody
200OKRecordedDisposalResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/environment/hazardous-waste/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKHazardousWasteDisposalDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

HrReport

1 endpoint
GET /api/v1/hr/summary
Parameters, body & responses
Responses
StatusMeaningBody
200OKHrSummaryDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

Incidents

1 endpoint
POST /api/v1/incidents
Parameters, body & responses
Request body application/json
FieldTypeDescription
projectId string · uuid
category string?
severity string?
title string?
note string?
Responses
StatusMeaningBody
200OKRaisedIncident
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Inductions

3 endpoints
POST /api/v1/inductions
Parameters, body & responses
Request body application/json
FieldTypeDescription
workerId string · uuid
projectId string · uuid
validFrom string · date-time
validTo string · date-time
Responses
StatusMeaningBody
200OKCreatedInduction
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/inductions/authorize
Parameters, body & responses
Request body application/json
FieldTypeDescription
workerId string · uuid
projectId string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/inductions/check
Parameters, body & responses
Parameters
NameInTypeDescription
workerId query string · uuid
projectId query string · uuid
Responses
StatusMeaningBody
200OKInductionCheck
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

InspectionPlans

4 endpoints
POST /api/v1/inspection-plans
Parameters, body & responses
Request body application/json
FieldTypeDescription
projectId string · uuid
productFamily string?
name string?
Responses
StatusMeaningBody
200OKCreatedPlanResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/inspection-plans/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKInspectionPlanDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/inspection-plans/{id}/points
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
stage string?
pointType string?
Responses
StatusMeaningBody
200OKCreatedPointResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/inspection-plans/{id}/points/{pointId}/checks
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
pointId* path string · uuid
Request body application/json
FieldTypeDescription
checkType string?
name string?
lowerTolerance number · double?
upperTolerance number · double?
Responses
StatusMeaningBody
200OKCreatedCheckResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Inspections

2 endpoints
POST /api/v1/inspections
Parameters, body & responses
Request body application/json
FieldTypeDescription
productionOrderId string · uuid
planId string · uuid
stage string?
result string?
evidenceRef string?
readings InspectionReadingInput[]?
Responses
StatusMeaningBody
200OKRecordedInspection
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/inspections/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKInspectionDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Installations

2 endpoints
GET /api/v1/installations/{productionOrderId}
Parameters, body & responses
Parameters
NameInTypeDescription
productionOrderId* path string · uuid
Responses
StatusMeaningBody
200OKInstallationDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/installations/advance
Parameters, body & responses
Request body application/json
FieldTypeDescription
productionOrderId string · uuid
stage string?
photoEvidenceRef string?
Responses
StatusMeaningBody
200OKInstallationDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Inventory

5 endpoints
POST /api/v1/inventory/adjustments

Raise a stock adjustment — routes to approval, changes no stock yet.

Parameters, body & responses
Request body application/json
FieldTypeDescription
materialId string · uuid
quantityDelta number · double
reason string?
Responses
StatusMeaningBody
200OKCreatedAdjustmentResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/inventory/adjustments/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKStockAdjustmentDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/inventory/adjustments/{id}/apply

Apply an approved adjustment — refused while its approval is pending.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/inventory/cycle-counts

Record a cycle count — writes the variance, never overwrites stock.

Parameters, body & responses
Request body application/json
FieldTypeDescription
materialId string · uuid
countedQuantity number · double
Responses
StatusMeaningBody
200OKCycleCountResult
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/inventory/reconciliation

Stock reconciliation (F4-01): materials whose on-hand disagrees with the documented movement ledger (receipts + applied adjustments − consumed) — the phantom-inventory signal. Empty is healthy. Behind `finance.view` so the monthly reviewer is finance (the petty-cash reconciler), not the storekeeper who could create the phantom stock.

Parameters, body & responses
Responses
StatusMeaningBody
200OKStockReconciliationDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

JobCards

5 endpoints
POST /api/v1/job-cards
Parameters, body & responses
Request body application/json
FieldTypeDescription
productionOrderId string · uuid
sequence integer · int32
operation string?
Responses
StatusMeaningBody
200OKCreatedJobCardResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/job-cards/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKJobCardDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/job-cards/{id}/complete
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/job-cards/{id}/scrap

Shop-floor scrap capture (P5) — a fixed reason code; raises the order's scrap quantity.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
quantity number · double
reasonCode string?
note string?
Responses
StatusMeaningBody
200OKRecordedScrapResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/job-cards/{id}/start

Start an operation — refused while a predecessor is not complete.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Leads

8 endpoints
GET /api/v1/leads
Parameters, body & responses
Parameters
NameInTypeDescription
source query string
stage query string
ownerId query string · uuid
includeInactive query boolean
page query integer · int32
pageSize query integer · int32
Responses
StatusMeaningBody
200OKLeadDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/leads
Parameters, body & responses
Request body application/json
FieldTypeDescription
customerId string · uuid
firstName string?
lastName string?
source string?
phone string?
workPhone string?
whatsapp string?
email string?
jobTitle string?
nationality string?
scopeOfWorkInterest string?
priority string?
ownerId string · uuid?
notes string?
doNotFollowUp boolean
Responses
StatusMeaningBody
200OKCreatedLeadResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/leads/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKLeadDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
PUT /api/v1/leads/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
customerId string · uuid
firstName string?
lastName string?
source string?
phone string?
workPhone string?
whatsapp string?
email string?
jobTitle string?
nationality string?
scopeOfWorkInterest string?
priority string?
ownerId string · uuid?
notes string?
doNotFollowUp boolean
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/leads/{id}/activities

Log a contact activity; auto-patches last-contact / next-follow-up on the lead.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
type string?
note string?
outcome string?
nextFollowUpDate string · date?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/leads/{id}/assign

Reassign a lead to a new owner (a member of this tenant); notifies the new owner.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
ownerId string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/leads/{id}/convert

Mark a WON lead converted — the seam F2's quotation consumes (no quotation created here).

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/leads/{id}/stage

Move a lead through the stage machine — a named command, optimistic-concurrency guarded.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
toStage string?
rowVersion integer · int32 The `xmin` the caller last read (from AlMaida.Erp.Application.Commercial.LeadDto.RowVersion).
reason string?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Leave

5 endpoints
GET /api/v1/leave/balances
Parameters, body & responses
Parameters
NameInTypeDescription
employeeId query string · uuid
leaveType query string
Responses
StatusMeaningBody
200OKBalanceResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/leave/balances
Parameters, body & responses
Request body application/json
FieldTypeDescription
employeeId string · uuid
leaveType string?
days number · double
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/leave/requests
Parameters, body & responses
Request body application/json
FieldTypeDescription
employeeId string · uuid
leaveType string?
startDate string · date
endDate string · date
Responses
StatusMeaningBody
200OKRaisedLeave
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/leave/requests/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKLeaveRequestDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/leave/requests/{id}/apply
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Machines

7 endpoints
GET /api/v1/machines
Parameters, body & responses
Parameters
NameInTypeDescription
includeInactive query boolean
Responses
StatusMeaningBody
200OKMachineDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/machines
Parameters, body & responses
Request body application/json
FieldTypeDescription
assetCode string?
name string?
capacity number · double?
calibrationDue string · date-time?
Responses
StatusMeaningBody
200OKCreatedMachineResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/machines/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKMachineDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
GET /api/v1/machines/{id}/assignable

The seam P1 consumes: may this machine be assigned to a production operation now?

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKAssignableResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/machines/{id}/deactivate
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/machines/{id}/downtime

Start a downtime interval (P6) — a fixed reason; a breakdown raises a ticket. One open at a time.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
reasonCode string?
note string?
Responses
StatusMeaningBody
200OKStartedDowntimeResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/machines/{id}/downtime/stop

Stop the machine's open downtime interval — fixes its duration.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Maintenance

4 endpoints
GET /api/v1/maintenance/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKWorkOrderDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/maintenance/{id}/close

Close a work order. A breakdown close completes its §22.1 ticket — the resolution note (what was fixed) is required and evidences the ticket's resolution; it restores the machine to assignable.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
resolutionNote string?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/maintenance/breakdown/{breakdownTicketId}

Raise a breakdown work order from a breakdown ticket.

Parameters, body & responses
Parameters
NameInTypeDescription
breakdownTicketId* path string · uuid
Responses
StatusMeaningBody
200OKCreatedWorkOrderResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/maintenance/preventive/{machineId}

Schedule a preventive-maintenance work order for a machine.

Parameters, body & responses
Parameters
NameInTypeDescription
machineId* path string · uuid
Responses
StatusMeaningBody
200OKCreatedWorkOrderResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Materials

6 endpoints
GET /api/v1/materials
Parameters, body & responses
Parameters
NameInTypeDescription
search query string
category query string
includeInactive query boolean
page query integer · int32
pageSize query integer · int32
Responses
StatusMeaningBody
200OKMaterialDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/materials
Parameters, body & responses
Request body application/json
FieldTypeDescription
code string?
name string?
unitOfMeasure string?
category string?
Responses
StatusMeaningBody
200OKCreatedMaterialResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/materials/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKMaterialDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/materials/{id}/deactivate
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/materials/{id}/reactivate
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/materials/{id}/receive

Non-PO goods-in (F4-01): raises an approval-gated positive stock adjustment (raiser ≠ approver); stock moves only when it is applied post-approval. Returns the pending adjustment id. 422 on an unknown receipt reason.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
quantity number · double
reason string?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Ncrs

4 endpoints
POST /api/v1/ncrs
Parameters, body & responses
Request body application/json
FieldTypeDescription
productionOrderId string · uuid
inspectionId string · uuid?
supplierId string · uuid?
Responses
StatusMeaningBody
200OKCreatedNcrResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/ncrs/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKNcrDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/ncrs/{id}/close
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKNcrDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/ncrs/{id}/disposition
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
disposition string?
causeCode string?
Responses
StatusMeaningBody
200OKNcrDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Nonconformities

2 endpoints
GET /api/v1/leads/{leadId}/nonconformities
Parameters, body & responses
Parameters
NameInTypeDescription
leadId* path string · uuid
Responses
StatusMeaningBody
200OKNonconformityDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/leads/{leadId}/nonconformities/{id}/status

Advance a nonconformity through the ISO lifecycle — a named command.

Parameters, body & responses
Parameters
NameInTypeDescription
leadId* path string · uuid
id* path string · uuid
Request body application/json
FieldTypeDescription
toStatus string?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Notifications

4 endpoints
GET /api/v1/notifications

This user's notifications, newest first (paged; unreadOnly filters to the unseen).

Parameters, body & responses
Parameters
NameInTypeDescription
unreadOnly query boolean
page query integer · int32
pageSize query integer · int32
Responses
StatusMeaningBody
200OKNotificationItem[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/notifications/{id}/read
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/notifications/read-all
Parameters, body & responses
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/notifications/unread-count

Count of this user's unread notifications (for a badge).

Parameters, body & responses
Responses
StatusMeaningBody
200OKinteger · int32
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

Oee

1 endpoint
GET /api/v1/oee/production-orders/{productionOrderId}
Parameters, body & responses
Parameters
NameInTypeDescription
productionOrderId* path string · uuid
Responses
StatusMeaningBody
200OKOeeReportDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Overtime

2 endpoints
POST /api/v1/overtime
Parameters, body & responses
Request body application/json
FieldTypeDescription
employeeId string · uuid
workDate string · date
hours number · double
Responses
StatusMeaningBody
200OKCapturedOvertime
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/overtime/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKOvertimeDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Payroll

3 endpoints
GET /api/v1/payroll/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKPayrollRunDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/payroll/runs
Parameters, body & responses
Request body application/json
FieldTypeDescription
period string?
Responses
StatusMeaningBody
200OKPayrollRunResult
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/payroll/runs/{id}/post
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Permits

3 endpoints
POST /api/v1/permits
Parameters, body & responses
Request body application/json
FieldTypeDescription
projectId string · uuid
workType string?
validFrom string · date-time
validTo string · date-time
Responses
StatusMeaningBody
200OKCreatedPermit
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/permits/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKPermitDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
GET /api/v1/permits/check
Parameters, body & responses
Parameters
NameInTypeDescription
projectId query string · uuid
workType query string
Responses
StatusMeaningBody
200OKPermitCheck
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

Portal

3 endpoints
GET /api/v1/portal/projects
Parameters, body & responses
Responses
StatusMeaningBody
200OKPortalProjectDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
GET /api/v1/portal/quotations
Parameters, body & responses
Responses
StatusMeaningBody
200OKPortalQuotationDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/portal/quotations/{id}/accept

The customer accepts a quotation sent to them — an audited write, confined to their own by RLS.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

ProductionOrders

4 endpoints
POST /api/v1/production-orders

Open a production order — the three-gate convergence; consumes the reservation.

Parameters, body & responses
Request body application/json
FieldTypeDescription
projectId string · uuid
drawingId string · uuid
reservationId string · uuid
machineId string · uuid
operatorId string · uuid
requiredCertification string?
quantity number · double
Responses
StatusMeaningBody
200OKCreatedProductionOrderResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/production-orders/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKProductionOrderDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/production-orders/{id}/cancel

Cancel an order opened by mistake — restores the reservation it consumed (stock given back, reservation re-activated). Refused once any job card has started; complete the order then instead.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
reason string?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/production-orders/{id}/complete

Complete the order — refused while job cards are outstanding; sets the inspection seam (P9).

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Profitability

1 endpoint
GET /api/v1/reports/profitability/{projectId}
Parameters, body & responses
Parameters
NameInTypeDescription
projectId* path string · uuid
Responses
StatusMeaningBody
200OKProjectProfitabilityDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Projects

8 endpoints
GET /api/v1/projects
Parameters, body & responses
Parameters
NameInTypeDescription
contractId query string · uuid
Responses
StatusMeaningBody
200OKProjectBaselineDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/projects
Parameters, body & responses
Request body application/json
FieldTypeDescription
contractId string · uuid
plannedStart string · date
plannedEnd string · date
Responses
StatusMeaningBody
200OKCreatedProjectBaselineResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/projects/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKProjectBaselineDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/projects/{id}/budget-lines

Add a budget line (estimate) keyed by cost category. Recomputes the budget total.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
category string?
estimatedAmount number · double
note string?
Responses
StatusMeaningBody
200OKCreatedBudgetLineResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/projects/{id}/lock

Lock — freeze the baseline; refused while an approval is pending.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/projects/{id}/milestones

Add a schedule milestone (weighted).

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
name string?
plannedDate string · date
weight number · double
Responses
StatusMeaningBody
200OKCreatedMilestoneResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/projects/{id}/submit

Submit — routes to approval at/above the budget threshold, else auto-approved.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/projects/milestones/{milestoneId}/complete

Complete a milestone — records the actual date and feeds the weighted completion %.

Parameters, body & responses
Parameters
NameInTypeDescription
milestoneId* path string · uuid
Request body application/json
FieldTypeDescription
actualDate string · date
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

PurchaseOrders

6 endpoints
GET /api/v1/purchase-orders

List POs, optionally filtered to one project (T1.2 — procurement cost roll-up by project).

Parameters, body & responses
Parameters
NameInTypeDescription
projectId query string · uuid
Responses
StatusMeaningBody
200OKPurchaseOrderDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/purchase-orders
Parameters, body & responses
Request body application/json
FieldTypeDescription
awardedBidId string · uuid
avlOverrideReason string?
Responses
StatusMeaningBody
200OKCreatedPurchaseOrderResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/purchase-orders/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKPurchaseOrderDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/purchase-orders/{id}/send

Send to supplier — the gate: refused while an approval is pending.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/purchase-orders/{id}/submit

Submit — routes to approval at/above the PO threshold, else auto-approved.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/purchase-orders/avl-overrides

The AVL-override review (F4-02): every PO raised on an off-AVL override. Gated to `suppliers.approve` — the vendor-policy authority (Finance Manager), NOT the buyer who raised them — so the recorded exceptions are actually reviewed, not just logged.

Parameters, body & responses
Responses
StatusMeaningBody
200OKAvlOverrideDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

QualityReports

1 endpoint
GET /api/v1/quality/reports/first-pass-yield
Parameters, body & responses
Parameters
NameInTypeDescription
from query string · date-time
to query string · date-time
Responses
StatusMeaningBody
200OKFirstPassYieldReport
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

QuantityRules

2 endpoints
GET /api/v1/quantity-rules

The rule for a node (404 if it has none).

Parameters, body & responses
Parameters
NameInTypeDescription
catalogNodeId query string · uuid
Responses
StatusMeaningBody
200OKQuantityRuleDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not FoundProblemDetails
POST /api/v1/quantity-rules

Create a node's quantity rule (409 if it already has one).

Parameters, body & responses
Request body application/json
FieldTypeDescription
catalogNodeId string · uuid
quantityBasis string?
conversionFormula string?
wastagePercent number · double
Responses
StatusMeaningBody
201Created—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409ConflictProblemDetails
422Unprocessable ContentProblemDetails

Quotations

6 endpoints
GET /api/v1/quotations
Parameters, body & responses
Parameters
NameInTypeDescription
leadId query string · uuid
Responses
StatusMeaningBody
200OKQuotationDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/quotations
Parameters, body & responses
Request body application/json
FieldTypeDescription
leadId string · uuid
totalAmount number · double
marginPct number · double
Responses
StatusMeaningBody
200OKCreatedQuotation
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/quotations/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKQuotationDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/quotations/{id}/revise

Create the next revision (a new row); the prior revision is left immutable.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
totalAmount number · double
marginPct number · double
Responses
StatusMeaningBody
200OKCreatedRevision
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/quotations/{id}/send

Send — gated: a pending_approval quotation can't be sent until approved.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/quotations/{id}/submit

Submit — routes to approval if below the margin floor, else approves.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Readiness

1 endpoint
GET /api/v1/admin/readiness
Parameters, body & responses
Responses
StatusMeaningBody
200OKReadinessReport
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

Receipts

3 endpoints
POST /api/v1/receipts
Parameters, body & responses
Request body application/json
FieldTypeDescription
projectId string · uuid
amount number · double
method string?
receivedOn string · date
reference string?
Responses
StatusMeaningBody
200OKReceiptResult
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/receipts/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKReceiptDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
GET /api/v1/receipts/project/{projectId}
Parameters, body & responses
Parameters
NameInTypeDescription
projectId* path string · uuid
Responses
StatusMeaningBody
200OKReceiptDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Reorder

2 endpoints
POST /api/v1/reorder/check

Run the reorder check — raises a replenishment requisition (once) if below the reorder point.

Parameters, body & responses
Request body application/json
FieldTypeDescription
projectId string · uuid
materialId string · uuid
estimatedUnitCost number · double
Responses
StatusMeaningBody
200OKReorderResult
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/reorder/policy/{materialId}

Set a material's reorder point, min/max levels, and ABC class.

Parameters, body & responses
Parameters
NameInTypeDescription
materialId* path string · uuid
Request body application/json
FieldTypeDescription
reorderPoint number · double
minQuantity number · double
maxQuantity number · double
abcClass string?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Requisitions

2 endpoints
GET /api/v1/requisitions/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKRequisitionDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/requisitions/check-shortfall

Availability check: raise a requisition for the shortfall (required − free), or nothing.

Parameters, body & responses
Request body application/json
FieldTypeDescription
projectId string · uuid
materialId string · uuid
requiredQuantity number · double
estimatedUnitCost number · double
Responses
StatusMeaningBody
200OKShortfallResult
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Reservations

4 endpoints
POST /api/v1/reservations

Reserve stock for a released drawing — holds the quantity (refused if the drawing is not released).

Parameters, body & responses
Request body application/json
FieldTypeDescription
materialId string · uuid
drawingId string · uuid
quantity number · double
Responses
StatusMeaningBody
200OKCreatedReservationResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/reservations/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKReservationDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/reservations/{id}/release

Release an active reservation — gives the held stock back to free.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/reservations/orphaned-holds

Orphaned holds (finding #3): still-active reservations whose drawing has been superseded — stock held against a revision production can no longer build. Read-only surface so a storekeeper can release or re-point them; it changes no stock. Gated to `materials.view`.

Parameters, body & responses
Responses
StatusMeaningBody
200OKOrphanedHoldDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

Rfqs

2 endpoints
POST /api/v1/rfqs

Issue an RFQ from an approved requisition to the given suppliers.

Parameters, body & responses
Request body application/json
FieldTypeDescription
requisitionId string · uuid
supplierIds string · uuid[]?
additionalRequisitionIds string · uuid[]?
Responses
StatusMeaningBody
200OKCreatedRfqResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/rfqs/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKRfqDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Roles

4 endpoints
POST /api/v1/roles
Parameters, body & responses
Request body application/json
FieldTypeDescription
name string?
description string?
Responses
StatusMeaningBody
200OKCreatedRoleResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
PUT /api/v1/roles/{id}/permissions
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
permissionCodes string[]?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/roles/conflicts

Registers a role-conflict pair and RETURNS the users who already hold both — surfacing pre-existing violators without revoking anyone (surface, don't surprise). Idempotent.

Parameters, body & responses
Request body application/json
FieldTypeDescription
roleA string?
roleB string?
Responses
StatusMeaningBody
200OKSoDViolation[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/roles/sod-violations

Standing separation-of-duties violations (F1-03) — users who currently hold both roles of a registered conflict pair. Assign-time enforcement can't catch dual-holders created by a later policy change; this is the re-check that surfaces them so a governance admin can act.

Parameters, body & responses
Responses
StatusMeaningBody
200OKSoDViolation[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

ServiceReports

1 endpoint
GET /api/v1/service/reports/summary
Parameters, body & responses
Responses
StatusMeaningBody
200OKServiceSummaryDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—

ServiceTickets

2 endpoints
POST /api/v1/service-tickets
Parameters, body & responses
Request body application/json
FieldTypeDescription
productionOrderId string · uuid
source string?
title string?
description string?
severity string?
Responses
StatusMeaningBody
200OKRaisedServiceTicket
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/service-tickets/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKServiceTicketDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Settings

2 endpoints
GET /api/v1/settings

All settings for the active company.

Parameters, body & responses
Responses
StatusMeaningBody
200OKCompanySettingDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
PUT /api/v1/settings/{key}

Update a setting's value (404 if the key isn't seeded, 422 on a type mismatch).

Parameters, body & responses
Parameters
NameInTypeDescription
key* path string
Request body application/json
FieldTypeDescription
value string?
Responses
StatusMeaningBody
204No Content—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not FoundProblemDetails
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails

Snags

2 endpoints
GET /api/v1/snags
Parameters, body & responses
Parameters
NameInTypeDescription
projectId query string · uuid
Responses
StatusMeaningBody
200OKSnagDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/snags
Parameters, body & responses
Request body application/json
FieldTypeDescription
projectId string · uuid
title string?
description string?
severity string?
Responses
StatusMeaningBody
200OKRaisedSnag
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Storage

2 endpoints
POST /api/v1/storage/download-url
Parameters, body & responses
Request body application/json
FieldTypeDescription
key string?
Responses
StatusMeaningBody
200OKDownloadTicket
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/storage/upload-url
Parameters, body & responses
Request body application/json
FieldTypeDescription
category string?
fileName string?
contentType string?
Responses
StatusMeaningBody
200OKUploadTicket
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

SupplierInvoices

2 endpoints
POST /api/v1/supplier-invoices

Record a supplier invoice and run the three-way match.

Parameters, body & responses
Request body application/json
FieldTypeDescription
purchaseOrderLineId string · uuid
invoiceNumber string?
invoicedQuantity number · double
invoicedUnitPrice number · double
Responses
StatusMeaningBody
200OKMatchResult
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/supplier-invoices/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKSupplierInvoiceDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Suppliers

8 endpoints
GET /api/v1/suppliers
Parameters, body & responses
Parameters
NameInTypeDescription
includeInactive query boolean
Responses
StatusMeaningBody
200OKSupplierDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/suppliers
Parameters, body & responses
Request body application/json
FieldTypeDescription
legalName string?
taxRegistration string?
contactEmail string?
contactPhone string?
paymentTerms string?
Responses
StatusMeaningBody
200OKCreatedSupplierResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/suppliers/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKSupplierDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/suppliers/{id}/approve

Vet a vendor onto the AVL (F4-02) — behind `suppliers.approve`, which the PO raiser (`suppliers.manage`/`purchasing.manage`) does NOT hold, so the approver is never the buyer. Records the approver + evaluation note (ISO 9001 8.4). 422 without a note.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
evaluationNote string?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/suppliers/{id}/deactivate
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/suppliers/{id}/reactivate
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/suppliers/{id}/revoke-approval

Revoke a vendor's AVL approval (expired licence, failed re-evaluation). Behind suppliers.approve.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/suppliers/{id}/scorecard

Read-only supplier scorecard (M11) — never mutates the supplier's AVL state.

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKSupplierScorecardDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Tickets

5 endpoints
POST /api/v1/tickets
Parameters, body & responses
Request body application/json
FieldTypeDescription
ticketType string?
title string?
description string?
severity string?
subjectType string?
subjectId string · uuid?
Responses
StatusMeaningBody
200OKCreatedTicket
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/tickets/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKTicketDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/tickets/{id}/assign
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
assigneeUserId string · uuid
Responses
StatusMeaningBody
200OKTicketDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/tickets/{id}/close
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
verificationNote string?
Responses
StatusMeaningBody
200OKTicketDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/tickets/{id}/resolve
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
resolutionNote string?
evidenceRef string?
Responses
StatusMeaningBody
200OKTicketDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Timesheets

2 endpoints
POST /api/v1/timesheets
Parameters, body & responses
Request body application/json
FieldTypeDescription
employeeId string · uuid
workDate string · date
allocations AllocationInput[]?
Responses
StatusMeaningBody
200OKSubmittedTimesheet
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/timesheets/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKTimesheetDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Training

3 endpoints
GET /api/v1/training/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKTrainingRecordDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
POST /api/v1/training/complete
Parameters, body & responses
Request body application/json
FieldTypeDescription
employeeId string · uuid
competencyCode string?
title string?
completedOn string · date-time
validTo string · date-time?
Responses
StatusMeaningBody
200OKTrainingResult
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/training/employee/{employeeId}
Parameters, body & responses
Parameters
NameInTypeDescription
employeeId* path string · uuid
Responses
StatusMeaningBody
200OKTrainingRecordDto[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

Users

8 endpoints
GET /api/v1/users

Members of the active company (paged, searchable).

Parameters, body & responses
Parameters
NameInTypeDescription
search query string
includeInactive query boolean
page query integer · int32
pageSize query integer · int32
Responses
StatusMeaningBody
200OKUserListItem[]
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
POST /api/v1/users

Create a user in the active company (email globally unique → 409 on duplicate).

Parameters, body & responses
Request body application/json
FieldTypeDescription
email string?
fullName string?
phone string?
initialPassword string?
roleIds string · uuid[]?
Responses
StatusMeaningBody
201Created—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409ConflictProblemDetails
422Unprocessable ContentProblemDetails
GET /api/v1/users/{id}

A single member of the active company (404 if not a member).

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKUserDetail
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not FoundProblemDetails
POST /api/v1/users/{id}/deactivate
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/users/{id}/reactivate
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/users/{id}/reset-password

Admin reset of another user's password (forces a change on next login, revokes their sessions).

Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
newPassword string?
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
POST /api/v1/users/{id}/roles
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Request body application/json
FieldTypeDescription
roleId string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
DELETE /api/v1/users/{id}/roles/{roleId}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
roleId* path string · uuid
Responses
StatusMeaningBody
200OK—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

Vehicles

2 endpoints
POST /api/v1/vehicles
Parameters, body & responses
Request body application/json
FieldTypeDescription
plateNumber string?
description string?
Responses
StatusMeaningBody
200OKCreatedResponse
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—
GET /api/v1/vehicles/{id}
Parameters, body & responses
Parameters
NameInTypeDescription
id* path string · uuid
Responses
StatusMeaningBody
200OKVehicleDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not found in the caller's tenant.—

WorkingCalendar

4 endpoints
GET /api/v1/admin/working-calendar

The current working calendar + holidays, or 404 if none is configured (24/7 fallback in effect).

Parameters, body & responses
Responses
StatusMeaningBody
200OKWorkingCalendarDto
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not FoundProblemDetails
PUT /api/v1/admin/working-calendar

Set the working calendar (upsert). 422 on degenerate config (no working day, inverted hours, out-of-range).

Parameters, body & responses
Request body application/json
FieldTypeDescription
workingDaysMask integer · int32
workStartHour integer · int32
workEndHour integer · int32
utcOffsetHours integer · int32
Responses
StatusMeaningBody
204No Content—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Unprocessable ContentProblemDetails
POST /api/v1/admin/working-calendar/holidays
Parameters, body & responses
Request body application/json
FieldTypeDescription
date string · date
description string?
Responses
StatusMeaningBody
204No Content—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
409ConflictProblemDetails
422Unprocessable ContentProblemDetails
DELETE /api/v1/admin/working-calendar/holidays/{date}
Parameters, body & responses
Parameters
NameInTypeDescription
date* path string · date
Responses
StatusMeaningBody
204No Content—
401No access token, or it is expired/invalid.—
403Authenticated, but the required permission is missing.—
404Not FoundProblemDetails
409Conflicts with existing state (duplicate, or a concurrency mismatch).—
422Well-formed, but a domain rule forbids it.—

No endpoints match your search.