MANSOQ Backend resource · STATIC DECLARATIONS
Enrollment API reference · mansoq-core
Static source contract for Enrollment: 11 declared or inherited operation mappings, schema/field evidence and authorization/refusal references. Deployment and behavioral review remain explicit.
Static API contract — behavior review pending. Source baseline f6e9f05f76d4.
Enable JavaScript to inspect structured operation, parameter, schema and permission evidence. Download this reference and its evidence.
Declared route and availability
This resource is declared in mansoq-core at /api/v1/facility/{facility_external_id}/rcm/enrollment/. verified core mount in config/urls.py A registered path and an indexed handler do not prove deployment availability, user permission or production readiness.
SET-09 Enrollment: discover, verify, resolve conflicts, endorse.
Nothing on this screen creates a policy or a class. discover records what
a channel returned; verify interprets a payer response; endorse maps
a coverage onto rows that already exist. A reference that does not resolve is
a 404, never an implicit create — that is the fake policy the screen exists
to prevent.
Operation map
| Method | Path | Action | Evidence |
|---|---|---|---|
| GET | /api/v1/facility/{facility_external_id}/rcm/enrollment/ |
list | declared/inherited method |
| GET | /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/ |
retrieve | declared/inherited method |
| GET | /api/v1/facility/{facility_external_id}/rcm/enrollment/discovery-ladder/ |
discovery_ladder | @action declaration |
| POST | /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/discover/ |
discover | @action declaration |
| POST | /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/verify/ |
verify | @action declaration |
| GET | /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/eligibility/ |
eligibility | @action declaration |
| POST | /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/freshness/ |
freshness | @action declaration |
| POST | /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/resolve-conflict/ |
resolve_conflict | @action declaration |
| POST | /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/divergences/ |
divergences | @action declaration |
| POST | /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/endorse/ |
endorse | @action declaration |
| GET | /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/estimate-restriction/ |
estimate_limits | @action declaration |
list · GET
GET /api/v1/facility/{facility_external_id}/rcm/enrollment/ — action list. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | patient |
not declared at read site | not established |
| query | {computed field name} |
not declared at read site | not established |
| query | unmapped |
not declared at read site | not established |
Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.
retrieve · GET
GET /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/ — action retrieve. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | patient |
not declared at read site | not established |
| query | {computed field name} |
not declared at read site | not established |
| query | unmapped |
not declared at read site | not established |
Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.
discovery_ladder · GET
The ch. 21 ladder in its configured total order.
A partial hierarchy silently promotes the rung below the missing one, so the engine refuses to build one; this surfaces that refusal by name.
GET /api/v1/facility/{facility_external_id}/rcm/enrollment/discovery-ladder/ — action discovery_ladder. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | config_package |
not declared at read site | not established |
| query | patient |
not declared at read site | not established |
| query | {computed field name} |
not declared at read site | not established |
| query | unmapped |
not declared at read site | not established |
Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.
discover · POST
Record what one rung of the ladder returned — never a determination.
A member card, an employer letter or a portal lookup can find a coverage. None of them is an eligibility answer, and the response says so in a field rather than leaving the desk to infer it.
POST /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/discover/ — action discover. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| body | config_package |
not declared at read site | not established |
| body | channel |
not declared at read site | not established |
| body | note |
not declared at read site | not established |
| body | coverages_found |
not declared at read site | not established |
| query | patient |
not declared at read site | not established |
| query | {computed field name} |
not declared at read site | not established |
| query | unmapped |
not declared at read site | not established |
Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.
verify · POST
Interpret one payer response and persist it, decomposed.
The write path is the engine's own persist_verification: the API does
not assemble a CoverageVerification by hand, so the offline-provenance
rule ("an exception has an owner") and the value/state CHECKs are enforced
on every call rather than on the ones that remembered.
POST /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/verify/ — action verify. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| body | config_package |
not declared at read site | not established |
| body | raw_request |
not declared at read site | not established |
| body | response |
not declared at read site | not established |
| query | patient |
not declared at read site | not established |
| query | {computed field name} |
not declared at read site | not established |
| query | unmapped |
not declared at read site | not established |
Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.
Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.
Declared refusal/error evidence: PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.
eligibility · GET
The eligibility surface: eight outcomes, seven axes, and both halves.
Report ch. 22 requires a desk to see the latest response and the context of the decision used for financial clearance at the same time. They are separate objects on purpose: the second is what a write-off argument turns on months later, and it must not be reconstructed from whatever the payer happens to say today.
GET /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/eligibility/ — action eligibility. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | config_package |
not declared at read site | not established |
| query | patient |
not declared at read site | not established |
| query | {computed field name} |
not declared at read site | not established |
| query | unmapped |
not declared at read site | not established |
Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.
freshness · POST
Is the recorded response still evidence for this request?
Freshness is a policy carrying a window, a day basis and the dimensions a material change is measured on. It is never a constant in code.
POST /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/freshness/ — action freshness. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| body | config_package |
not declared at read site | not established |
| body | prior |
not declared at read site | not established |
| query | patient |
not declared at read site | not established |
| query | {computed field name} |
not declared at read site | not established |
| query | unmapped |
not declared at read site | not established |
Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.
resolve_conflict · POST
Reconcile two conflicting statements — and keep both.
Report ch. 21: neither statement is discarded. The reconciliation says which was retained for this decision and opens a queue; the losing statement stays on the record, because the one that was discarded is the one an appeal will ask about.
POST /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/resolve-conflict/ — action resolve_conflict. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| body | config_package |
not declared at read site | not established |
| body | statements |
not declared at read site | not established |
| body | coordination_candidates |
not declared at read site | not established |
| query | patient |
not declared at read site | not established |
| query | {computed field name} |
not declared at read site | not established |
| query | unmapped |
not declared at read site | not established |
Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: ValidationError: resolve-conflict compares exactly two presented statements.; PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.
divergences · POST
Map observed check-to-claim divergences onto their documented hooks.
POST /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/divergences/ — action divergences. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| body | config_package |
not declared at read site | not established |
| body | observed |
not declared at read site | not established |
| body | point_in_time |
not declared at read site | not established |
| query | patient |
not declared at read site | not established |
| query | {computed field name} |
not declared at read site | not established |
| query | unmapped |
not declared at read site | not established |
Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.
endorse · POST
Map a captured coverage onto configuration that already exists.
Every reference is resolved against a stored row. The endpoint has no create path for a policy or a class, because "no forced fake policy/class for unknown response" is the failure SET-09 exists to prevent — and the cheapest way to commit it is an endorsement screen that upserts.
The write goes through full_clean(), so the coverage-period
value/state CHECK runs here and not only in a migration.
POST /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/endorse/ — action endorse. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| body | status |
not declared at read site | direct indexing; validation may be upstream |
| body | presented_evidence |
not declared at read site | not established |
| body | coverage_period_state |
not declared at read site | not established |
| body | policy |
not declared at read site | direct indexing; validation may be upstream |
| body | benefit_class |
not declared at read site | direct indexing; validation may be upstream |
| query | patient |
not declared at read site | not established |
| query | {computed field name} |
not declared at read site | not established |
| query | unmapped |
not declared at read site | not established |
Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: ValidationError: evidence_required; An endorsement records patient-specific coverage periods and the evidence for them. Nothing may be endorsed on no evidence.; PermissionDenied: Cannot update revenue-cycle records; ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot read revenue-cycle records.
estimate_limits · GET
What an estimate against this coverage may assert — and what it may not.
GET /api/v1/facility/{facility_external_id}/rcm/enrollment/{external_id}/estimate-restriction/ — action estimate_limits. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | patient |
not declared at read site | not established |
| query | {computed field name} |
not declared at read site | not established |
| query | unmapped |
not declared at read site | not established |
Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.
Integration review checklist
Confirm the installed route and full schema; review authentication, organization/facility scoping, all accepted fields, value-state and date/time semantics, idempotency, pagination, response/exception branches and the allowed correction/reversal workflow. Test positive and negative cases with synthetic data. This source reference does not establish external certification or replace an illustrated user procedure.
Pinned source evidence
Links require access to the private source repository.
- repositories/platform/mansoq-core/config/api_router.py:944
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/eligibility.py:364
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/eligibility.py:399
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/eligibility.py:379
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/operations_base.py:629
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/operations_base.py:596
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/operations_base.py:591
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/eligibility.py:404
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/eligibility.py:411
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/eligibility.py:436
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/operations_base.py:602
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/eligibility.py:468
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/operations_base.py:636
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/eligibility.py:531
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/eligibility.py:571
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/eligibility.py:617
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/eligibility.py:705
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/eligibility.py:740
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/eligibility.py:817
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/rcm/eligibility.py:812