Encounter API reference · mansoq-core

Declared route and availability

This resource is declared in mansoq-core at /api/v1/encounter/. verified core mount in config/urls.py A registered path and an indexed handler do not prove deployment availability, user permission or production readiness.

Operation map

list · GET

GET /api/v1/encounter/ — action list. static contract extracted; runtime/permission/payload behavior review pending.

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

response: EncounterListSpec. Declared fields below; inherited fields are retained in the schema inventory.

Observed authorization checks: can_view_patient_obj, get_filtered_encounters. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters.

create · POST

POST /api/v1/encounter/ — action create. static contract extracted; runtime/permission/payload behavior review pending.

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

request: EncounterCreateSpec. Declared fields below; inherited fields are retained in the schema inventory.

response: EncounterRetrieveSpec. Declared fields below; inherited fields are retained in the schema inventory.

Observed authorization checks: can_view_patient_obj, get_filtered_encounters, can_create_encounter_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters; PermissionDenied: You do not have permission to create encounter; ValidationError (dynamic detail; inspect source); ValidationError: Patient does not exist; ValidationError: Facility does not exist; ValidationError: Encounter already has an associated booking; ValidationError: Encounter creation failed, try again after a while.

Conditional gates: conditional/computed expression; inspect pinned declaration comparison settings.MAX_ACTIVE_ENCOUNTERS_PER_PATIENT_IN_FACILITY.

retrieve · GET

GET /api/v1/encounter/{external_id}/ — action retrieve. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

response: EncounterRetrieveSpec. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

Observed authorization checks: can_view_patient_obj, get_filtered_encounters, can_view_encounter_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters; PermissionDenied: You do not have permission to view this patient.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

update · PUT

PUT /api/v1/encounter/{external_id}/ — action update. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

request: EncounterUpdateSpec. Declared fields below; inherited fields are retained in the schema inventory.

response: EncounterRetrieveSpec. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

Observed authorization checks: can_view_patient_obj, get_filtered_encounters, can_update_encounter_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters; PermissionDenied: You do not have permission to update encounter; ValidationError (dynamic detail; inspect source); ValidationError: Patient does not exist; ValidationError: Facility does not exist.

Conditional gates: conditional/computed expression; inspect pinned declaration comparison settings.MAX_ACTIVE_ENCOUNTERS_PER_PATIENT_IN_FACILITY.

partial_update · PATCH

PATCH /api/v1/encounter/{external_id}/ — action partial_update. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

request: EncounterUpdateSpec. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

response: EncounterRetrieveSpec. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

Observed authorization checks: can_view_patient_obj, get_filtered_encounters, can_update_encounter_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters; ValidationError (dynamic detail; inspect source); ValidationError: Patient does not exist; ValidationError: Facility does not exist; PermissionDenied: You do not have permission to update encounter.

Conditional gates: conditional/computed expression; inspect pinned declaration comparison settings.MAX_ACTIVE_ENCOUNTERS_PER_PATIENT_IN_FACILITY.

set_tags · POST

POST /api/v1/encounter/{external_id}/set_tags/ — action set_tags. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

decorator request: TagRequest. Declared fields below; inherited fields are retained in the schema inventory.

Observed authorization checks: can_view_patient_obj, get_filtered_encounters, can_update_encounter_obj, can_view_encounter_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters; RestFrameworkValidationError (dynamic detail; inspect source); PermissionDenied: You do not have permission to update encounter; PermissionDenied: You do not have permission to view this patient.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

remove_tags · POST

POST /api/v1/encounter/{external_id}/remove_tags/ — action remove_tags. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

body validation: TagRequest. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

decorator request: TagRequest. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

Observed authorization checks: can_view_patient_obj, get_filtered_encounters, can_update_encounter_obj, can_view_encounter_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters; PermissionDenied: You do not have permission to update encounter; PermissionDenied: You do not have permission to view this patient.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

emergency_board · GET

In-progress emergency encounters of a facility in board order.

GET /api/v1/encounter/emergency_board/ — action emergency_board. static contract extracted; runtime/permission/payload behavior review pending.

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: get_filtered_encounters, can_view_patient_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters.

triage · POST

Record a triage level from the facility's configured triage scale.

POST /api/v1/encounter/{external_id}/triage/ — action triage. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

decorator request: TriageRecordSpec. Declared fields below; inherited fields are retained in the schema inventory.

Observed authorization checks: can_update_encounter_clinical_data, can_view_patient_obj, get_filtered_encounters. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_201_CREATED. Other branches/framework exception handling may differ.

Declared refusal/error evidence: PermissionDenied: You do not have permission to triage encounter; ValidationError (dynamic detail; inspect source); PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters.

restart · POST

Moves the encounter to from a completed state to an in progress state

POST /api/v1/encounter/{external_id}/restart/ — action restart. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_restart_encounter_obj, can_view_patient_obj, get_filtered_encounters. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_204_NO_CONTENT. Other branches/framework exception handling may differ.

Declared refusal/error evidence: PermissionDenied: You do not have permission to update encounter; ValidationError: Encounter is not in a completed state; ValidationError (dynamic detail; inspect source); PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters.

organizations · GET

Returns organizations associated with the encounter

GET /api/v1/encounter/{external_id}/organizations/ — action organizations. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_view_patient_obj, get_filtered_encounters, can_view_encounter_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters; PermissionDenied: You do not have permission to view this patient.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

organizations_add · POST

POST /api/v1/encounter/{external_id}/organizations_add/ — action organizations_add. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

decorator responses: FacilityOrganizationReadSpec. Declared fields below; inherited fields are retained in the schema inventory.

Observed authorization checks: can_view_patient_obj, get_filtered_encounters, can_update_encounter_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Organization Incompatible with Encounter; ValidationError: Organization already exists; PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters; PermissionDenied: You do not have permission to update encounter.

organizations_remove · DELETE

DELETE /api/v1/encounter/{external_id}/organizations_remove/ — action organizations_remove. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_view_patient_obj, get_filtered_encounters, can_update_encounter_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Organization Incompatible with Encounter; ValidationError: Organization does not exist; PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters; PermissionDenied: You do not have permission to update encounter.

set_facility_identifier · POST

POST /api/v1/encounter/{external_id}/set_facility_identifier/ — action set_facility_identifier. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_view_patient_obj, get_filtered_encounters, can_update_encounter_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters; PermissionDenied: You do not have permission to update encounter.

set_care_team_members · POST

POST /api/v1/encounter/{external_id}/set_care_team_members/ — action set_care_team_members. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

decorator request: EncounterCareTeamMemberWriteSpec. Declared fields below; inherited fields are retained in the schema inventory.

decorator responses: EncounterRetrieveSpec. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

Observed authorization checks: can_view_encounter_obj, can_view_patient_obj, get_filtered_encounters, can_update_encounter_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied: Treating doctor does not have permission on encounter; PermissionDenied: User cannot access patient; PermissionDenied: Cannot access encounters; PermissionDenied: You do not have permission to update encounter.

Integration review checklist

Confirm the installed route and full schema; review authentication, organization/facility scoping, all accepted fields, value-state and date/time semantics, idempotency, pagination, response/exception branches and the allowed correction/reversal workflow. Test positive and negative cases with synthetic data. This source reference does not establish external certification or replace an illustrated user procedure.