Dispense Order API reference · mansoq-core

Declared route and availability

This resource is declared in mansoq-core at /api/v1/facility/{facility_external_id}/order/dispense/. verified core mount in config/urls.py A registered path and an indexed handler do not prove deployment availability, user permission or production readiness.

Operation map

list · GET

GET /api/v1/facility/{facility_external_id}/order/dispense/ — action list. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

response: MedicationDispenseOrderReadSpec. Declared fields below; inherited fields are retained in the schema inventory.

Observed authorization checks: can_view_as_pharmacist, can_list_facility_supply_delivery. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Location is required for non-pharmacists; PermissionDenied: You do not have permission to read dispense order.

create · POST

POST /api/v1/facility/{facility_external_id}/order/dispense/ — action create. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

request: MedicationDispenseOrderWriteSpec. Declared fields below; inherited fields are retained in the schema inventory.

response: MedicationDispenseOrderRetrieveSpec. Declared fields below; inherited fields are retained in the schema inventory.

Observed authorization checks: can_view_as_pharmacist, can_list_facility_supply_delivery, can_write_facility_supply_delivery. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Location is required for non-pharmacists; PermissionDenied: You do not have permission to read dispense order; PermissionDenied: You do not have permission to create dispense order; ValidationError: Location must be in the same facility.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

retrieve · GET

GET /api/v1/facility/{facility_external_id}/order/dispense/{external_id}/ — action retrieve. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

response: MedicationDispenseOrderRetrieveSpec. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

Observed authorization checks: can_view_as_pharmacist, can_list_facility_supply_delivery. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Location is required for non-pharmacists; PermissionDenied: You do not have permission to read dispense order.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

update · PUT

PUT /api/v1/facility/{facility_external_id}/order/dispense/{external_id}/ — action update. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

request: BaseMedicationDispenseOrderSpec. Declared fields below; inherited fields are retained in the schema inventory.

response: MedicationDispenseOrderRetrieveSpec. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

Observed authorization checks: can_view_as_pharmacist, can_list_facility_supply_delivery, can_write_facility_supply_delivery. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Location is required for non-pharmacists; PermissionDenied: You do not have permission to read dispense order; PermissionDenied: You do not have permission to update dispense order; ValidationError: Dispense order already abandoned or entered in error; ValidationError: Completed dispense order can only be cancelled.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

partial_update · PATCH

PATCH /api/v1/facility/{facility_external_id}/order/dispense/{external_id}/ — action partial_update. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

request: BaseMedicationDispenseOrderSpec. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

response: MedicationDispenseOrderRetrieveSpec. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

Observed authorization checks: can_view_as_pharmacist, can_list_facility_supply_delivery. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Location is required for non-pharmacists; PermissionDenied: You do not have permission to read dispense order; PermissionDenied: You do not have permission to update dispense order; ValidationError: Dispense order already abandoned or entered in error; ValidationError: Completed dispense order can only be cancelled.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

upsert · POST

POST /api/v1/facility/{facility_external_id}/order/dispense/upsert/ — action upsert. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_view_as_pharmacist, can_list_facility_supply_delivery, can_write_facility_supply_delivery. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 400. Other branches/framework exception handling may differ.

Declared refusal/error evidence: RestFrameworkValidationError: Invalid request data; RestFrameworkValidationError: No datapoints provided; RestFrameworkValidationError: Too many datapoints provided; ValidationError: Location is required for non-pharmacists; PermissionDenied: You do not have permission to read dispense order; PermissionDenied: You do not have permission to update dispense order; ValidationError: Dispense order already abandoned or entered in error; ValidationError: Completed dispense order can only be cancelled; PermissionDenied: You do not have permission to create dispense order; ValidationError: Location must be in the same facility.

Conditional gates: conditional/computed expression; inspect pinned declaration comparison settings.MAX_DATAPOINTS_PER_UPSERT.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

Integration review checklist

Confirm the installed route and full schema; review authentication, organization/facility scoping, all accepted fields, value-state and date/time semantics, idempotency, pagination, response/exception branches and the allowed correction/reversal workflow. Test positive and negative cases with synthetic data. This source reference does not establish external certification or replace an illustrated user procedure.