Authorization Workbench API reference · mansoq-core

Declared route and availability

This resource is declared in mansoq-core at /api/v1/facility/{facility_external_id}/rcm/authorizations/. verified core mount in config/urls.py A registered path and an indexed handler do not prove deployment availability, user permission or production readiness.

Prior authorizations, their clocks and the four amendment intents.

Operation map

list · GET

GET /api/v1/facility/{facility_external_id}/rcm/authorizations/ — action list. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.

retrieve · GET

GET /api/v1/facility/{facility_external_id}/rcm/authorizations/{external_id}/ — action retrieve. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.

clocks · GET

Every turnaround obligation running against this request.

Evaluated at as_of through the engine rather than read from a stored status, because a stored status is what still says "pending" an hour after the obligation expired.

GET /api/v1/facility/{facility_external_id}/rcm/authorizations/{external_id}/clocks/ — action clocks. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.

lines · GET

Per-line review decisions, requested against authorized.

GET /api/v1/facility/{facility_external_id}/rcm/authorizations/{external_id}/lines/ — action lines. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.

observe · POST

Record an inbound message against a running clock.

Gate NP-U25: a queued outcome does not stop the clock, because nothing published says it does. The clock keeps running and the case is flagged contested — never silently approved, never silently held.

POST /api/v1/facility/{facility_external_id}/rcm/authorizations/{external_id}/observe/ — action observe. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot update revenue-cycle records; ValidationError: No matching turnaround clock. Name one explicitly with 'clock'.; PermissionDenied: Cannot read revenue-cycle records.

deem · POST

Take a deemed approval — or say, item by item, why it may not be taken.

The refusal is the useful answer. assess_deeming returns every blocker and every missing evidence fact rather than the first one, so a desk can close them in one pass instead of discovering them one call at a time.

POST /api/v1/facility/{facility_external_id}/rcm/authorizations/{external_id}/deem/ — action deem. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: dynamic status. Other branches/framework exception handling may differ.

Declared refusal/error evidence: PermissionDenied: Cannot update revenue-cycle records; ValidationError: No matching turnaround clock. Name one explicitly with 'clock'.; ValidationError: config_package_missing; A deemed approval names the configuration package it was taken under. None is published.; ValidationError: config_package_not_found; ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot read revenue-cycle records.

amend · POST

Plan one of the four intents. There is no fifth, and no "resubmit".

Returns the mechanism, the relationship and — for an amendment — the complete service snapshot with its sequences fixed. Nothing is transmitted here: the plan is what the operator approves before a transaction is cut.

POST /api/v1/facility/{facility_external_id}/rcm/authorizations/{external_id}/amend/ — action amend. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

cancel · POST

Plan a cancellation. Its vocabulary is constrained and conflicted.

POST /api/v1/facility/{facility_external_id}/rcm/authorizations/{external_id}/cancel/ — action cancel. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

sufficiency · POST

Does the approval still cover what is about to happen?

unresolved opens a queue. It never auto-denies and it never blocks clinical care — the flag saying so is on the wire.

POST /api/v1/facility/{facility_external_id}/rcm/authorizations/{external_id}/sufficiency/ — action sufficiency. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: line must reference a line of this authorization; PermissionDenied: Cannot read revenue-cycle records.

tat_rules · GET

The published turnaround obligations, with their instruments.

GET /api/v1/facility/{facility_external_id}/rcm/authorizations/tat-rules/ — action tat_rules. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.

exemptions · GET

Published cases in which no prior authorization is required.

Exempt from approval is not exempt from telling the payer, so the notification duty is rendered alongside — and its computability is a field, because a duty whose hours are unknown is not a duty anyone can meet.

GET /api/v1/facility/{facility_external_id}/rcm/authorizations/exemptions/ — action exemptions. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.

Integration review checklist

Confirm the installed route and full schema; review authentication, organization/facility scoping, all accepted fields, value-state and date/time semantics, idempotency, pagination, response/exception branches and the allowed correction/reversal workflow. Test positive and negative cases with synthetic data. This source reference does not establish external certification or replace an illustrated user procedure.