ApprovalsAdmin
2 endpoints
GET
/api/v1/admin/approvals
Every pending approval in the company: what it waits on, since when, and whether it is stranded.
Parameters, body & responses
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | InFlightApproval[] |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
POST
/api/v1/admin/approvals/{id}/override
Break-glass: approve a pending request past its remaining levels with a logged reason (§13.2).
The engine re-checks the permission and raiser ≠ overrider, and it works even on a stranded document
(it does not read the — possibly deleted — current level). 422 on an empty reason or the raiser.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| reason |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 204 | No Content | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Unprocessable Content | ProblemDetails |
Catalog
6 endpoints
GET
/api/v1/catalog/nodes
List nodes, optionally filtered by parent and/or level.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| parentId |
query |
string · uuid |
|
| level |
query |
string |
|
| includeInactive |
query |
boolean |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CatalogNodeDto[] |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
POST
/api/v1/catalog/nodes
Create a catalog node (optionally under a parent).
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| parentId |
string · uuid? |
|
| level |
string? |
|
| name |
string? |
|
| uom |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 201 | Created | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Unprocessable Content | ProblemDetails |
PUT
/api/v1/catalog/nodes/{id}
Rename / re-UoM / (de)activate a node.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| name |
string? |
|
| uom |
string? |
|
| isActive |
boolean |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
GET
/api/v1/catalog/nodes/{id}/rate
The rate effective at asOf (default today). 404 unknown node, 422 no rate — no parent fallback.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
| asOf |
query |
string · date |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | ResolvedRateDto |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not Found | ProblemDetails |
| 422 | Unprocessable Content | ProblemDetails |
GET
/api/v1/catalog/rates
A node's rates, optionally those covering a given date; newest-effective first.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| nodeId |
query |
string · uuid |
|
| effectiveOn |
query |
string · date |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | RateCardDto[] |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
POST
/api/v1/catalog/rates
Add a time-bounded rate to a node.
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| catalogNodeId |
string · uuid |
|
| unitCost |
number · double |
|
| uom |
string? |
|
| effectiveFrom |
string · date |
|
| effectiveTo |
string · date? |
|
| sourceType |
string? |
|
| sourceRef |
string? |
|
| supplierId |
string · uuid? |
|
Responses
| Status | Meaning | Body |
|---|
| 201 | Created | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Unprocessable Content | ProblemDetails |
Drawings
7 endpoints
GET
/api/v1/drawings
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| contractId |
query |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | DrawingDto[] |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
POST
/api/v1/drawings
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| contractId |
string · uuid |
|
| drawingNumber |
string? |
|
| title |
string? |
|
| discipline |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CreatedDrawingResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
GET
/api/v1/drawings/{id}
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | DrawingDto |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
POST
/api/v1/drawings/{id}/release
Release — gated on review approval; supersedes the prior released revision.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| rowVersion |
integer · int32 |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
GET
/api/v1/drawings/{id}/release-check
The seam production consumes: may work proceed against this drawing revision?
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | ReleaseCheckResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
POST
/api/v1/drawings/{id}/revise
Create the next revision (a new row); the prior revision is left immutable.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| title |
string? |
|
| discipline |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CreatedDrawingResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/drawings/{id}/submit
Submit a draft revision for review — routes through the approval engine.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
Estimates
11 endpoints
POST
/api/v1/estimates
Create a draft estimate.
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| quotationId |
string · uuid? |
|
| estimateType |
string? |
|
| overheadPercent |
number · double |
|
| marginPercent |
number · double |
|
Responses
| Status | Meaning | Body |
|---|
| 201 | Created | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Unprocessable Content | ProblemDetails |
GET
/api/v1/estimates/{id}
The estimate with its priced lines and rolled-up totals. The cost basis (unit/line cost, overhead,
margin, total cost) is MASKED to null for a caller without `estimates.cost.view` — a price-only
reader (e.g. Sales) sees quantities and selling, never the cost behind them.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | EstimateDto |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not Found | ProblemDetails |
POST
/api/v1/estimates/{id}/approve
Approver signs a verified estimate — it becomes immutable (cannot be the maker or verifier). Verified → Approved.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 204 | No Content | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Unprocessable Content | ProblemDetails |
POST
/api/v1/estimates/{id}/lines
Add a catalog line (CatalogNodeId) or a custom line (CustomDescription + CustomUnitCost).
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| catalogNodeId |
string · uuid? |
|
| customDescription |
string? |
|
| quantity |
number · double |
|
| uom |
string? |
|
| customUnitCost |
number · double? |
|
| customCostEvidence |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 201 | Created | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Unprocessable Content | ProblemDetails |
PUT
/api/v1/estimates/{id}/lines/{lineNo}/evidence
Attach/replace the cost justification on a custom line (draft only). 422 on a catalog line or empty evidence.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
| lineNo* |
path |
integer · int32 |
|
Request body application/json
| Field | Type | Description |
|---|
| evidence |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 204 | No Content | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not Found | ProblemDetails |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Unprocessable Content | ProblemDetails |
POST
/api/v1/estimates/{id}/lines/{lineNo}/price
Run the pricing engine on a line and return the breakdown (422 if the line's node has no rate).
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
| lineNo* |
path |
integer · int32 |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | PricedLineDto |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not Found | ProblemDetails |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Unprocessable Content | ProblemDetails |
POST
/api/v1/estimates/{id}/lines/{lineNo}/promote
Promote a proven custom line (on an approved estimate) into the catalog as a new node + a 'promoted'
rate at the line's unit cost. Needs `catalog.manage` — it writes to the shared catalog. Returns
the new node id. 422 on a catalog line, an already-promoted line, or a non-approved estimate.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
| lineNo* |
path |
integer · int32 |
|
Request body application/json
| Field | Type | Description |
|---|
| name |
string? |
|
| level |
string? |
|
| parentId |
string · uuid? |
|
Responses
| Status | Meaning | Body |
|---|
| 201 | Created | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not Found | ProblemDetails |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Unprocessable Content | ProblemDetails |
POST
/api/v1/estimates/{id}/lines/import
Bulk-add lines from a BOQ in one atomic call — all land or none do. Returns the new line numbers.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| lines |
AddEstimateLineInput[]? |
|
Responses
| Status | Meaning | Body |
|---|
| 201 | Created | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not Found | ProblemDetails |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Unprocessable Content | ProblemDetails |
POST
/api/v1/estimates/{id}/reject
Send a submitted or verified estimate back to the maker for rework. → Draft.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 204 | No Content | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Unprocessable Content | ProblemDetails |
POST
/api/v1/estimates/{id}/submit
Maker submits a draft for verification (needs at least one line). Draft → Submitted.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 204 | No Content | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Unprocessable Content | ProblemDetails |
POST
/api/v1/estimates/{id}/verify
Verifier signs a submitted estimate (cannot be the maker). Submitted → Verified.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 204 | No Content | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Unprocessable Content | ProblemDetails |
Inventory
5 endpoints
POST
/api/v1/inventory/adjustments
Raise a stock adjustment — routes to approval, changes no stock yet.
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| materialId |
string · uuid |
|
| quantityDelta |
number · double |
|
| reason |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CreatedAdjustmentResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
GET
/api/v1/inventory/adjustments/{id}
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | StockAdjustmentDto |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
POST
/api/v1/inventory/adjustments/{id}/apply
Apply an approved adjustment — refused while its approval is pending.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/inventory/cycle-counts
Record a cycle count — writes the variance, never overwrites stock.
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| materialId |
string · uuid |
|
| countedQuantity |
number · double |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CycleCountResult |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
GET
/api/v1/inventory/reconciliation
Stock reconciliation (F4-01): materials whose on-hand disagrees with the documented movement
ledger (receipts + applied adjustments − consumed) — the phantom-inventory signal. Empty is healthy.
Behind `finance.view` so the monthly reviewer is finance (the petty-cash reconciler), not the
storekeeper who could create the phantom stock.
Parameters, body & responses
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | StockReconciliationDto[] |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
Leads
8 endpoints
GET
/api/v1/leads
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| source |
query |
string |
|
| stage |
query |
string |
|
| ownerId |
query |
string · uuid |
|
| includeInactive |
query |
boolean |
|
| page |
query |
integer · int32 |
|
| pageSize |
query |
integer · int32 |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | LeadDto[] |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
POST
/api/v1/leads
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| customerId |
string · uuid |
|
| firstName |
string? |
|
| lastName |
string? |
|
| source |
string? |
|
| phone |
string? |
|
| workPhone |
string? |
|
| whatsapp |
string? |
|
| email |
string? |
|
| jobTitle |
string? |
|
| nationality |
string? |
|
| scopeOfWorkInterest |
string? |
|
| priority |
string? |
|
| ownerId |
string · uuid? |
|
| notes |
string? |
|
| doNotFollowUp |
boolean |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CreatedLeadResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
GET
/api/v1/leads/{id}
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | LeadDto |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
PUT
/api/v1/leads/{id}
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| customerId |
string · uuid |
|
| firstName |
string? |
|
| lastName |
string? |
|
| source |
string? |
|
| phone |
string? |
|
| workPhone |
string? |
|
| whatsapp |
string? |
|
| email |
string? |
|
| jobTitle |
string? |
|
| nationality |
string? |
|
| scopeOfWorkInterest |
string? |
|
| priority |
string? |
|
| ownerId |
string · uuid? |
|
| notes |
string? |
|
| doNotFollowUp |
boolean |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/leads/{id}/activities
Log a contact activity; auto-patches last-contact / next-follow-up on the lead.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| type |
string? |
|
| note |
string? |
|
| outcome |
string? |
|
| nextFollowUpDate |
string · date? |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/leads/{id}/assign
Reassign a lead to a new owner (a member of this tenant); notifies the new owner.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| ownerId |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/leads/{id}/convert
Mark a WON lead converted — the seam F2's quotation consumes (no quotation created here).
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/leads/{id}/stage
Move a lead through the stage machine — a named command, optimistic-concurrency guarded.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| toStage |
string? |
|
| rowVersion |
integer · int32 |
The `xmin` the caller last read (from AlMaida.Erp.Application.Commercial.LeadDto.RowVersion). |
| reason |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
Machines
7 endpoints
GET
/api/v1/machines
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| includeInactive |
query |
boolean |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | MachineDto[] |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
POST
/api/v1/machines
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| assetCode |
string? |
|
| name |
string? |
|
| capacity |
number · double? |
|
| calibrationDue |
string · date-time? |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CreatedMachineResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
GET
/api/v1/machines/{id}
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | MachineDto |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
GET
/api/v1/machines/{id}/assignable
The seam P1 consumes: may this machine be assigned to a production operation now?
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | AssignableResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
POST
/api/v1/machines/{id}/deactivate
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/machines/{id}/downtime
Start a downtime interval (P6) — a fixed reason; a breakdown raises a ticket. One open at a time.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| reasonCode |
string? |
|
| note |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | StartedDowntimeResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/machines/{id}/downtime/stop
Stop the machine's open downtime interval — fixes its duration.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
Maintenance
4 endpoints
GET
/api/v1/maintenance/{id}
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | WorkOrderDto |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
POST
/api/v1/maintenance/{id}/close
Close a work order. A breakdown close completes its §22.1 ticket — the resolution note (what
was fixed) is required and evidences the ticket's resolution; it restores the machine to assignable.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| resolutionNote |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/maintenance/breakdown/{breakdownTicketId}
Raise a breakdown work order from a breakdown ticket.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| breakdownTicketId* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CreatedWorkOrderResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/maintenance/preventive/{machineId}
Schedule a preventive-maintenance work order for a machine.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| machineId* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CreatedWorkOrderResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
ProductionOrders
4 endpoints
POST
/api/v1/production-orders
Open a production order — the three-gate convergence; consumes the reservation.
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| projectId |
string · uuid |
|
| drawingId |
string · uuid |
|
| reservationId |
string · uuid |
|
| machineId |
string · uuid |
|
| operatorId |
string · uuid |
|
| requiredCertification |
string? |
|
| quantity |
number · double |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CreatedProductionOrderResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
GET
/api/v1/production-orders/{id}
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | ProductionOrderDto |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
POST
/api/v1/production-orders/{id}/cancel
Cancel an order opened by mistake — restores the reservation it consumed (stock given back,
reservation re-activated). Refused once any job card has started; complete the order then instead.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| reason |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/production-orders/{id}/complete
Complete the order — refused while job cards are outstanding; sets the inspection seam (P9).
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
Projects
8 endpoints
GET
/api/v1/projects
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| contractId |
query |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | ProjectBaselineDto[] |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
POST
/api/v1/projects
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| contractId |
string · uuid |
|
| plannedStart |
string · date |
|
| plannedEnd |
string · date |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CreatedProjectBaselineResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
GET
/api/v1/projects/{id}
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | ProjectBaselineDto |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
POST
/api/v1/projects/{id}/budget-lines
Add a budget line (estimate) keyed by cost category. Recomputes the budget total.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| category |
string? |
|
| estimatedAmount |
number · double |
|
| note |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CreatedBudgetLineResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/projects/{id}/lock
Lock — freeze the baseline; refused while an approval is pending.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/projects/{id}/milestones
Add a schedule milestone (weighted).
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| name |
string? |
|
| plannedDate |
string · date |
|
| weight |
number · double |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CreatedMilestoneResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/projects/{id}/submit
Submit — routes to approval at/above the budget threshold, else auto-approved.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/projects/milestones/{milestoneId}/complete
Complete a milestone — records the actual date and feeds the weighted completion %.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| milestoneId* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| actualDate |
string · date |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
PurchaseOrders
6 endpoints
GET
/api/v1/purchase-orders
List POs, optionally filtered to one project (T1.2 — procurement cost roll-up by project).
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| projectId |
query |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | PurchaseOrderDto[] |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
POST
/api/v1/purchase-orders
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| awardedBidId |
string · uuid |
|
| avlOverrideReason |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CreatedPurchaseOrderResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
GET
/api/v1/purchase-orders/{id}
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | PurchaseOrderDto |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
POST
/api/v1/purchase-orders/{id}/send
Send to supplier — the gate: refused while an approval is pending.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/purchase-orders/{id}/submit
Submit — routes to approval at/above the PO threshold, else auto-approved.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
GET
/api/v1/purchase-orders/avl-overrides
The AVL-override review (F4-02): every PO raised on an off-AVL override. Gated to
`suppliers.approve` — the vendor-policy authority (Finance Manager), NOT the buyer who raised
them — so the recorded exceptions are actually reviewed, not just logged.
Parameters, body & responses
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | AvlOverrideDto[] |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
Suppliers
8 endpoints
GET
/api/v1/suppliers
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| includeInactive |
query |
boolean |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | SupplierDto[] |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
POST
/api/v1/suppliers
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| legalName |
string? |
|
| taxRegistration |
string? |
|
| contactEmail |
string? |
|
| contactPhone |
string? |
|
| paymentTerms |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | CreatedSupplierResponse |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
GET
/api/v1/suppliers/{id}
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | SupplierDto |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
POST
/api/v1/suppliers/{id}/approve
Vet a vendor onto the AVL (F4-02) — behind `suppliers.approve`, which the PO raiser
(`suppliers.manage`/`purchasing.manage`) does NOT hold, so the approver is never the buyer.
Records the approver + evaluation note (ISO 9001 8.4). 422 without a note.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| evaluationNote |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/suppliers/{id}/deactivate
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/suppliers/{id}/reactivate
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/suppliers/{id}/revoke-approval
Revoke a vendor's AVL approval (expired licence, failed re-evaluation). Behind suppliers.approve.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
GET
/api/v1/suppliers/{id}/scorecard
Read-only supplier scorecard (M11) — never mutates the supplier's AVL state.
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | SupplierScorecardDto |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
Users
8 endpoints
GET
/api/v1/users
Members of the active company (paged, searchable).
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| search |
query |
string |
|
| includeInactive |
query |
boolean |
|
| page |
query |
integer · int32 |
|
| pageSize |
query |
integer · int32 |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | UserListItem[] |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
POST
/api/v1/users
Create a user in the active company (email globally unique → 409 on duplicate).
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| email |
string? |
|
| fullName |
string? |
|
| phone |
string? |
|
| initialPassword |
string? |
|
| roleIds |
string · uuid[]? |
|
Responses
| Status | Meaning | Body |
|---|
| 201 | Created | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflict | ProblemDetails |
| 422 | Unprocessable Content | ProblemDetails |
GET
/api/v1/users/{id}
A single member of the active company (404 if not a member).
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | UserDetail |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not Found | ProblemDetails |
POST
/api/v1/users/{id}/deactivate
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/users/{id}/reactivate
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/users/{id}/reset-password
Admin reset of another user's password (forces a change on next login, revokes their sessions).
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| newPassword |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
POST
/api/v1/users/{id}/roles
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
Request body application/json
| Field | Type | Description |
|---|
| roleId |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
DELETE
/api/v1/users/{id}/roles/{roleId}
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| id* |
path |
string · uuid |
|
| roleId* |
path |
string · uuid |
|
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not found in the caller's tenant. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
WorkingCalendar
4 endpoints
GET
/api/v1/admin/working-calendar
The current working calendar + holidays, or 404 if none is configured (24/7 fallback in effect).
Parameters, body & responses
Responses
| Status | Meaning | Body |
|---|
| 200 | OK | WorkingCalendarDto |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not Found | ProblemDetails |
PUT
/api/v1/admin/working-calendar
Set the working calendar (upsert). 422 on degenerate config (no working day, inverted hours, out-of-range).
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| workingDaysMask |
integer · int32 |
|
| workStartHour |
integer · int32 |
|
| workEndHour |
integer · int32 |
|
| utcOffsetHours |
integer · int32 |
|
Responses
| Status | Meaning | Body |
|---|
| 204 | No Content | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Unprocessable Content | ProblemDetails |
POST
/api/v1/admin/working-calendar/holidays
Parameters, body & responses
Request body application/json
| Field | Type | Description |
|---|
| date |
string · date |
|
| description |
string? |
|
Responses
| Status | Meaning | Body |
|---|
| 204 | No Content | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 409 | Conflict | ProblemDetails |
| 422 | Unprocessable Content | ProblemDetails |
DELETE
/api/v1/admin/working-calendar/holidays/{date}
Parameters, body & responses
Parameters
| Name | In | Type | Description |
|---|
| date* |
path |
string · date |
|
Responses
| Status | Meaning | Body |
|---|
| 204 | No Content | — |
| 401 | No access token, or it is expired/invalid. | — |
| 403 | Authenticated, but the required permission is missing. | — |
| 404 | Not Found | ProblemDetails |
| 409 | Conflicts with existing state (duplicate, or a concurrency mismatch). | — |
| 422 | Well-formed, but a domain rule forbids it. | — |
No endpoints match your search.