← Technical API reference

Backend resource · STATIC DECLARATIONS

Revenue Cycle API reference · mansoq-core

Static source contract for Revenue Cycle: 35 declared or inherited operation mappings, schema/field evidence and authorization/refusal references. Deployment and behavioral review remain explicit.

Static API contract — behavior review pending. Source baseline f6e9f05f76d4.

Enable JavaScript to inspect structured operation, parameter, schema and permission evidence. Download this reference and its evidence.

Declared route and availability

This resource is declared in mansoq-core at /api/v1/facility/{facility_external_id}/revenue_cycle/. verified core mount in config/urls.py A registered path and an indexed handler do not prove deployment availability, user permission or production readiness.

Operation map

Method Path Action Evidence
GET /api/v1/facility/{facility_external_id}/revenue_cycle/ list declared/inherited method
POST /api/v1/facility/{facility_external_id}/revenue_cycle/ create declared/inherited method
GET /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/ retrieve declared/inherited method
GET /api/v1/facility/{facility_external_id}/revenue_cycle/dashboard/ dashboard @action declaration
GET /api/v1/facility/{facility_external_id}/revenue_cycle/nphies/ nphies @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/nphies/ nphies @action declaration
GET /api/v1/facility/{facility_external_id}/revenue_cycle/coverage/ coverage @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/coverage/ coverage @action declaration
PATCH /api/v1/facility/{facility_external_id}/revenue_cycle/coverage/ coverage @action declaration
GET /api/v1/facility/{facility_external_id}/revenue_cycle/insurance/ insurance @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/insurance/ insurance @action declaration
PATCH /api/v1/facility/{facility_external_id}/revenue_cycle/insurance/ insurance @action declaration
GET /api/v1/facility/{facility_external_id}/revenue_cycle/configuration/ configuration @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/configuration/ configuration @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/eligibility/ eligibility @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/nphies-communication/ nphies_communication @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/nphies-payment-notice/ nphies_payment_notice @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/nphies-support/ nphies_support @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/estimate/ estimate @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/authorization/ authorization @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/utilization_review/ utilization_review @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/charge_audit/ charge_audit @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/coding/ coding @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/build_claim/ build_claim @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/submit_claim/ submit_claim @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/adjudicate/ adjudicate @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/remittance/ remittance @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/denial/ denial @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/collection/ collection @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/work_item/ work_item @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/transition/ transition @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/prepare-insured-visit/ prepare_insured_visit @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/commit-insured-visit/ commit_insured_visit @action declaration
POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/recalculate/ recalculate @action declaration
GET /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/audit/ audit @action declaration

list · GET

GET /api/v1/facility/{facility_external_id}/revenue_cycle/ — action list. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
query {computed field name} not declared at read site not established

Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.

create · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/ — action create. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body encounter not declared at read site direct indexing; validation may be upstream
body coverage not declared at read site direct indexing; validation may be upstream
body account not declared at read site not established
body financial_class not declared at read site not established
body claim_type not declared at read site not established
body priority not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.

Declared refusal/error evidence: PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

retrieve · GET

GET /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/ — action retrieve. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
query {computed field name} not declared at read site not established

Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.

dashboard · GET

GET /api/v1/facility/{facility_external_id}/revenue_cycle/dashboard/ — action dashboard. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
query {computed field name} not declared at read site not established

Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.

nphies · GET

Manage non-secret NPHIES activation metadata and readiness.

GET /api/v1/facility/{facility_external_id}/revenue_cycle/nphies/ — action nphies. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body location_type_code not declared at read site direct indexing; validation may be upstream
query {computed field name} not declared at read site not established

Observed authorization checks: can_read_account_in_facility, can_update_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Production delivery requires certified NPHIES activation; PermissionDenied: Cannot read revenue-cycle records; PermissionDenied: Cannot update revenue-cycle records.

Conditional gates: environment != production; configuration.environment = production and configuration.allow_live_submission and configuration.certification_status != certified.

nphies · POST

Manage non-secret NPHIES activation metadata and readiness.

POST /api/v1/facility/{facility_external_id}/revenue_cycle/nphies/ — action nphies. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body location_type_code not declared at read site direct indexing; validation may be upstream
query {computed field name} not declared at read site not established

Observed authorization checks: can_read_account_in_facility, can_update_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Production delivery requires certified NPHIES activation; PermissionDenied: Cannot read revenue-cycle records; PermissionDenied: Cannot update revenue-cycle records.

Conditional gates: environment != production; configuration.environment = production and configuration.allow_live_submission and configuration.certification_status != certified.

coverage · GET

GET /api/v1/facility/{facility_external_id}/revenue_cycle/coverage/ — action coverage. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body plan not declared at read site direct indexing; validation may be upstream
body policy_class not declared at read site direct indexing; validation may be upstream
body network not declared at read site direct indexing; validation may be upstream
query patient not declared at read site not established
body patient not declared at read site not established
body payer not declared at read site not established
body member_id not declared at read site not established
body subscriber_id not declared at read site not established
body dependent_number not declared at read site not established
body group_number not declared at read site not established
body policy_number not declared at read site not established
body card_number not declared at read site not established
body card_issued_at not declared at read site not established
body card_expires_at not declared at read site not established
body policy_holder not declared at read site not established
body employer not declared at read site not established
body relationship not declared at read site not established
body coverage_type not declared at read site not established
body direct_billing not declared at read site not established
body priority not declared at read site not established
body status not declared at read site not established
body period not declared at read site not established
body benefits not declared at read site not established
body coordination_of_benefits not declared at read site not established
body id not declared at read site not established
body rcm_member_coverage not declared at read site direct indexing; validation may be upstream
query {computed field name} not declared at read site not established

Observed authorization checks: can_read_account_in_facility, can_update_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Only a published active policy can be assigned; ValidationError: Only a published active benefit class can be assigned; ValidationError: An existing canonical coverage binding cannot be cleared through the general coverage editor; ValidationError: A canonical coverage binding cannot be silently replaced; PermissionDenied: Cannot read revenue-cycle records; PermissionDenied: Cannot update revenue-cycle records.

coverage · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/coverage/ — action coverage. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body plan not declared at read site direct indexing; validation may be upstream
body policy_class not declared at read site direct indexing; validation may be upstream
body network not declared at read site direct indexing; validation may be upstream
query patient not declared at read site not established
body patient not declared at read site not established
body payer not declared at read site not established
body member_id not declared at read site not established
body subscriber_id not declared at read site not established
body dependent_number not declared at read site not established
body group_number not declared at read site not established
body policy_number not declared at read site not established
body card_number not declared at read site not established
body card_issued_at not declared at read site not established
body card_expires_at not declared at read site not established
body policy_holder not declared at read site not established
body employer not declared at read site not established
body relationship not declared at read site not established
body coverage_type not declared at read site not established
body direct_billing not declared at read site not established
body priority not declared at read site not established
body status not declared at read site not established
body period not declared at read site not established
body benefits not declared at read site not established
body coordination_of_benefits not declared at read site not established
body id not declared at read site not established
body rcm_member_coverage not declared at read site direct indexing; validation may be upstream
query {computed field name} not declared at read site not established

Observed authorization checks: can_read_account_in_facility, can_update_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Only a published active policy can be assigned; ValidationError: Only a published active benefit class can be assigned; ValidationError: An existing canonical coverage binding cannot be cleared through the general coverage editor; ValidationError: A canonical coverage binding cannot be silently replaced; PermissionDenied: Cannot read revenue-cycle records; PermissionDenied: Cannot update revenue-cycle records.

coverage · PATCH

PATCH /api/v1/facility/{facility_external_id}/revenue_cycle/coverage/ — action coverage. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body plan not declared at read site direct indexing; validation may be upstream
body policy_class not declared at read site direct indexing; validation may be upstream
body network not declared at read site direct indexing; validation may be upstream
query patient not declared at read site not established
body patient not declared at read site not established
body payer not declared at read site not established
body member_id not declared at read site not established
body subscriber_id not declared at read site not established
body dependent_number not declared at read site not established
body group_number not declared at read site not established
body policy_number not declared at read site not established
body card_number not declared at read site not established
body card_issued_at not declared at read site not established
body card_expires_at not declared at read site not established
body policy_holder not declared at read site not established
body employer not declared at read site not established
body relationship not declared at read site not established
body coverage_type not declared at read site not established
body direct_billing not declared at read site not established
body priority not declared at read site not established
body status not declared at read site not established
body period not declared at read site not established
body benefits not declared at read site not established
body coordination_of_benefits not declared at read site not established
body id not declared at read site not established
body rcm_member_coverage not declared at read site direct indexing; validation may be upstream
query {computed field name} not declared at read site not established

Observed authorization checks: can_read_account_in_facility, can_update_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Only a published active policy can be assigned; ValidationError: Only a published active benefit class can be assigned; ValidationError: An existing canonical coverage binding cannot be cleared through the general coverage editor; ValidationError: A canonical coverage binding cannot be silently replaced; PermissionDenied: Cannot read revenue-cycle records; PermissionDenied: Cannot update revenue-cycle records.

insurance · GET

Embedded payer hierarchy configuration and policy governance.

GET /api/v1/facility/{facility_external_id}/revenue_cycle/insurance/ — action insurance. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body resource_type not declared at read site not established
body operation not declared at read site direct indexing; validation may be upstream
body id not declared at read site not established
body network not declared at read site not established
body administrator not declared at read site direct indexing; validation may be upstream
body canonical_insurer_org not declared at read site not established
body name not declared at read site direct indexing; validation may be upstream
body code not declared at read site not established
body display_label not declared at read site not established
body administrator_type not declared at read site not established
body status not declared at read site not established
body regulator not declared at read site not established
body country_code not declared at read site not established
body tpa_license not declared at read site not established
body nphies_identifier not declared at read site not established
body national_identifier not declared at read site not established
body commercial_registration not declared at read site not established
body tax_number not declared at read site not established
body effective_from not declared at read site not established
body effective_to not declared at read site not established
body contact not declared at read site not established
body address not declared at read site not established
body endpoint_configuration not declared at read site not established
body capabilities not declared at read site not established
body service_scope not declared at read site not established
body accreditation not declared at read site not established
body legal_name not declared at read site not established
body payer_code not declared at read site direct indexing; validation may be upstream
body insurer_type not declared at read site not established
body nphies_license not declared at read site not established
body organization_identifier not declared at read site not established
body identifiers not declared at read site not established
body operational_rules not declared at read site not established
body network_directory_url not declared at read site not established
body payer not declared at read site not established
body tier not declared at read site not established
body direct_billing not declared at read site not established
body out_of_network_coverage not declared at read site not established
body provider_directory_url not declared at read site not established
body geographical_scope not declared at read site not established
body service_areas not declared at read site not established
body rules not declared at read site not established
body plan_code not declared at read site direct indexing; validation may be upstream
body version not declared at read site not established
body policy_number not declared at read site direct indexing; validation may be upstream
body policy_type not declared at read site not established
body market_segment not declared at read site not established
body policy_holder_type not declared at read site not established
body policy_holder_name not declared at read site not established
body policy_holder_identifier not declared at read site not established
body regulator_product_code not declared at read site not established
body coverage_type not declared at read site not established
body product_type not declared at read site not established
body product_tier not declared at read site not established
body annual_maximum not declared at read site not established
body lifetime_maximum not declared at read site not established
body room_class not declared at read site not established
body pharmacy_formulary not declared at read site not established
body grace_period_days not declared at read site not established
body issue_date not declared at read site not established
body renewal_date not declared at read site not established
body coverage_rules not declared at read site not established
body cost_share_rules not declared at read site not established
body general_conditions not declared at read site not established
body exclusions not declared at read site not established
body documents not declared at read site not established
body policy not declared at read site not established
body description not declared at read site not established
body room_type not declared at read site not established
body deductible_period not declared at read site not established
body authorization_default validated by _tri_state_input helper default; inspect declaration
body referral_default validated by _tri_state_input helper default; inspect declaration
body eligibility_rules not declared at read site not established
body policy_class not declared at read site not established
body code_system not declared at read site not established
body benefit_category not declared at read site not established
body coverage_status not declared at read site not established
body network_scope not declared at read site not established
body limit_type not declared at read site not established
body limit_period not declared at read site not established
body deductible_applies validated by _tri_state_input helper default; inspect declaration
body authorization_required validated by _tri_state_input helper default; inspect declaration
body referral_required validated by _tri_state_input helper default; inspect declaration
body waiting_period_days not declared at read site not established
body minimum_age not declared at read site not established
body maximum_age not declared at read site not established
body gender not declared at read site not established
body emergency_override validated by _tri_state_input helper default; inspect declaration
body conditions not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_read_rcm_configuration_in_facility, can_edit_rcm_configuration_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Unsupported policy operation; ValidationError: Unsupported insurance resource_type; ValidationError: A payer route with bound canonical members cannot be silently remapped; use a controlled migration; ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot read insurance configuration; PermissionDenied: Cannot edit insurance configuration; PermissionDenied: Cannot read revenue-cycle records.

insurance · POST

Embedded payer hierarchy configuration and policy governance.

POST /api/v1/facility/{facility_external_id}/revenue_cycle/insurance/ — action insurance. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body resource_type not declared at read site not established
body operation not declared at read site direct indexing; validation may be upstream
body id not declared at read site not established
body network not declared at read site not established
body administrator not declared at read site direct indexing; validation may be upstream
body canonical_insurer_org not declared at read site not established
body name not declared at read site direct indexing; validation may be upstream
body code not declared at read site not established
body display_label not declared at read site not established
body administrator_type not declared at read site not established
body status not declared at read site not established
body regulator not declared at read site not established
body country_code not declared at read site not established
body tpa_license not declared at read site not established
body nphies_identifier not declared at read site not established
body national_identifier not declared at read site not established
body commercial_registration not declared at read site not established
body tax_number not declared at read site not established
body effective_from not declared at read site not established
body effective_to not declared at read site not established
body contact not declared at read site not established
body address not declared at read site not established
body endpoint_configuration not declared at read site not established
body capabilities not declared at read site not established
body service_scope not declared at read site not established
body accreditation not declared at read site not established
body legal_name not declared at read site not established
body payer_code not declared at read site direct indexing; validation may be upstream
body insurer_type not declared at read site not established
body nphies_license not declared at read site not established
body organization_identifier not declared at read site not established
body identifiers not declared at read site not established
body operational_rules not declared at read site not established
body network_directory_url not declared at read site not established
body payer not declared at read site not established
body tier not declared at read site not established
body direct_billing not declared at read site not established
body out_of_network_coverage not declared at read site not established
body provider_directory_url not declared at read site not established
body geographical_scope not declared at read site not established
body service_areas not declared at read site not established
body rules not declared at read site not established
body plan_code not declared at read site direct indexing; validation may be upstream
body version not declared at read site not established
body policy_number not declared at read site direct indexing; validation may be upstream
body policy_type not declared at read site not established
body market_segment not declared at read site not established
body policy_holder_type not declared at read site not established
body policy_holder_name not declared at read site not established
body policy_holder_identifier not declared at read site not established
body regulator_product_code not declared at read site not established
body coverage_type not declared at read site not established
body product_type not declared at read site not established
body product_tier not declared at read site not established
body annual_maximum not declared at read site not established
body lifetime_maximum not declared at read site not established
body room_class not declared at read site not established
body pharmacy_formulary not declared at read site not established
body grace_period_days not declared at read site not established
body issue_date not declared at read site not established
body renewal_date not declared at read site not established
body coverage_rules not declared at read site not established
body cost_share_rules not declared at read site not established
body general_conditions not declared at read site not established
body exclusions not declared at read site not established
body documents not declared at read site not established
body policy not declared at read site not established
body description not declared at read site not established
body room_type not declared at read site not established
body deductible_period not declared at read site not established
body authorization_default validated by _tri_state_input helper default; inspect declaration
body referral_default validated by _tri_state_input helper default; inspect declaration
body eligibility_rules not declared at read site not established
body policy_class not declared at read site not established
body code_system not declared at read site not established
body benefit_category not declared at read site not established
body coverage_status not declared at read site not established
body network_scope not declared at read site not established
body limit_type not declared at read site not established
body limit_period not declared at read site not established
body deductible_applies validated by _tri_state_input helper default; inspect declaration
body authorization_required validated by _tri_state_input helper default; inspect declaration
body referral_required validated by _tri_state_input helper default; inspect declaration
body waiting_period_days not declared at read site not established
body minimum_age not declared at read site not established
body maximum_age not declared at read site not established
body gender not declared at read site not established
body emergency_override validated by _tri_state_input helper default; inspect declaration
body conditions not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_read_rcm_configuration_in_facility, can_edit_rcm_configuration_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Unsupported policy operation; ValidationError: Unsupported insurance resource_type; ValidationError: A payer route with bound canonical members cannot be silently remapped; use a controlled migration; ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot read insurance configuration; PermissionDenied: Cannot edit insurance configuration; PermissionDenied: Cannot read revenue-cycle records.

insurance · PATCH

Embedded payer hierarchy configuration and policy governance.

PATCH /api/v1/facility/{facility_external_id}/revenue_cycle/insurance/ — action insurance. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body resource_type not declared at read site not established
body operation not declared at read site direct indexing; validation may be upstream
body id not declared at read site not established
body network not declared at read site not established
body administrator not declared at read site direct indexing; validation may be upstream
body canonical_insurer_org not declared at read site not established
body name not declared at read site direct indexing; validation may be upstream
body code not declared at read site not established
body display_label not declared at read site not established
body administrator_type not declared at read site not established
body status not declared at read site not established
body regulator not declared at read site not established
body country_code not declared at read site not established
body tpa_license not declared at read site not established
body nphies_identifier not declared at read site not established
body national_identifier not declared at read site not established
body commercial_registration not declared at read site not established
body tax_number not declared at read site not established
body effective_from not declared at read site not established
body effective_to not declared at read site not established
body contact not declared at read site not established
body address not declared at read site not established
body endpoint_configuration not declared at read site not established
body capabilities not declared at read site not established
body service_scope not declared at read site not established
body accreditation not declared at read site not established
body legal_name not declared at read site not established
body payer_code not declared at read site direct indexing; validation may be upstream
body insurer_type not declared at read site not established
body nphies_license not declared at read site not established
body organization_identifier not declared at read site not established
body identifiers not declared at read site not established
body operational_rules not declared at read site not established
body network_directory_url not declared at read site not established
body payer not declared at read site not established
body tier not declared at read site not established
body direct_billing not declared at read site not established
body out_of_network_coverage not declared at read site not established
body provider_directory_url not declared at read site not established
body geographical_scope not declared at read site not established
body service_areas not declared at read site not established
body rules not declared at read site not established
body plan_code not declared at read site direct indexing; validation may be upstream
body version not declared at read site not established
body policy_number not declared at read site direct indexing; validation may be upstream
body policy_type not declared at read site not established
body market_segment not declared at read site not established
body policy_holder_type not declared at read site not established
body policy_holder_name not declared at read site not established
body policy_holder_identifier not declared at read site not established
body regulator_product_code not declared at read site not established
body coverage_type not declared at read site not established
body product_type not declared at read site not established
body product_tier not declared at read site not established
body annual_maximum not declared at read site not established
body lifetime_maximum not declared at read site not established
body room_class not declared at read site not established
body pharmacy_formulary not declared at read site not established
body grace_period_days not declared at read site not established
body issue_date not declared at read site not established
body renewal_date not declared at read site not established
body coverage_rules not declared at read site not established
body cost_share_rules not declared at read site not established
body general_conditions not declared at read site not established
body exclusions not declared at read site not established
body documents not declared at read site not established
body policy not declared at read site not established
body description not declared at read site not established
body room_type not declared at read site not established
body deductible_period not declared at read site not established
body authorization_default validated by _tri_state_input helper default; inspect declaration
body referral_default validated by _tri_state_input helper default; inspect declaration
body eligibility_rules not declared at read site not established
body policy_class not declared at read site not established
body code_system not declared at read site not established
body benefit_category not declared at read site not established
body coverage_status not declared at read site not established
body network_scope not declared at read site not established
body limit_type not declared at read site not established
body limit_period not declared at read site not established
body deductible_applies validated by _tri_state_input helper default; inspect declaration
body authorization_required validated by _tri_state_input helper default; inspect declaration
body referral_required validated by _tri_state_input helper default; inspect declaration
body waiting_period_days not declared at read site not established
body minimum_age not declared at read site not established
body maximum_age not declared at read site not established
body gender not declared at read site not established
body emergency_override validated by _tri_state_input helper default; inspect declaration
body conditions not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_read_rcm_configuration_in_facility, can_edit_rcm_configuration_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Unsupported policy operation; ValidationError: Unsupported insurance resource_type; ValidationError: A payer route with bound canonical members cannot be silently remapped; use a controlled migration; ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot read insurance configuration; PermissionDenied: Cannot edit insurance configuration; PermissionDenied: Cannot read revenue-cycle records.

configuration · GET

GET /api/v1/facility/{facility_external_id}/revenue_cycle/configuration/ — action configuration. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body resource_type not declared at read site not established
body name not declared at read site direct indexing; validation may be upstream
body payer_code not declared at read site direct indexing; validation may be upstream
body nphies_license not declared at read site not established
body organization_identifier not declared at read site not established
body contact not declared at read site not established
body endpoint_configuration not declared at read site not established
body plan not declared at read site direct indexing; validation may be upstream
body canonical_insurer_org not declared at read site not established
body payer not declared at read site not established
body plan_code not declared at read site direct indexing; validation may be upstream
body product_type not declared at read site not established
body network not declared at read site not established
body effective_from not declared at read site direct indexing; validation may be upstream
body effective_to not declared at read site not established
body coverage_rules not declared at read site not established
body cost_share_rules not declared at read site not established
body version not declared at read site not established
body status not declared at read site not established
body reimbursement_method not declared at read site not established
body terms not declared at read site not established
body reimbursement_rules not declared at read site not established
body contract not declared at read site not established
body service_system not declared at read site direct indexing; validation may be upstream
body service_code not declared at read site direct indexing; validation may be upstream
body rate_type not declared at read site not established
body amount not declared at read site not established
body percentage not declared at read site not established
body unit not declared at read site not established
body modifiers not declared at read site not established
body code not declared at read site direct indexing; validation may be upstream
body category not declared at read site direct indexing; validation may be upstream
body severity not declared at read site not established
body rule not declared at read site not established
body remediation not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_read_rcm_configuration_in_facility, can_edit_rcm_configuration_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Unsupported RCM configuration resource_type; PermissionDenied: Cannot read insurance configuration; PermissionDenied: Cannot edit insurance configuration; PermissionDenied: Cannot read revenue-cycle records.

configuration · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/configuration/ — action configuration. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body resource_type not declared at read site not established
body name not declared at read site direct indexing; validation may be upstream
body payer_code not declared at read site direct indexing; validation may be upstream
body nphies_license not declared at read site not established
body organization_identifier not declared at read site not established
body contact not declared at read site not established
body endpoint_configuration not declared at read site not established
body plan not declared at read site direct indexing; validation may be upstream
body canonical_insurer_org not declared at read site not established
body payer not declared at read site not established
body plan_code not declared at read site direct indexing; validation may be upstream
body product_type not declared at read site not established
body network not declared at read site not established
body effective_from not declared at read site direct indexing; validation may be upstream
body effective_to not declared at read site not established
body coverage_rules not declared at read site not established
body cost_share_rules not declared at read site not established
body version not declared at read site not established
body status not declared at read site not established
body reimbursement_method not declared at read site not established
body terms not declared at read site not established
body reimbursement_rules not declared at read site not established
body contract not declared at read site not established
body service_system not declared at read site direct indexing; validation may be upstream
body service_code not declared at read site direct indexing; validation may be upstream
body rate_type not declared at read site not established
body amount not declared at read site not established
body percentage not declared at read site not established
body unit not declared at read site not established
body modifiers not declared at read site not established
body code not declared at read site direct indexing; validation may be upstream
body category not declared at read site direct indexing; validation may be upstream
body severity not declared at read site not established
body rule not declared at read site not established
body remediation not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_read_rcm_configuration_in_facility, can_edit_rcm_configuration_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Unsupported RCM configuration resource_type; PermissionDenied: Cannot read insurance configuration; PermissionDenied: Cannot edit insurance configuration; PermissionDenied: Cannot read revenue-cycle records.

eligibility · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/eligibility/ — action eligibility. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body result not declared at read site not established
body outcome not declared at read site not established
body response_bundle not declared at read site not established
body benefits not declared at read site not established
body errors not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Manual eligibility outcomes are restricted to DEBUG onboarding. Production outcomes must arrive in a signed NPHIES response.; ValidationError: No queued eligibility request exists; ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

Conditional gates: not settings.DEBUG or conditional/computed expression; inspect pinned declaration != onboarding.

nphies_communication · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/nphies-communication/ — action nphies_communication. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body kind not declared at read site not established
body about_reference not declared at read site not established
body based_on_communication not declared at read site direct indexing; validation may be upstream
body claim not declared at read site direct indexing; validation may be upstream
body authorization not declared at read site direct indexing; validation may be upstream
body category not declared at read site not established
body payload not declared at read site not established
body attachments not declared at read site not established
body subject not declared at read site not established
body claim_item_sequence not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Coverage is required for NPHIES communication; ValidationError: Providers send information submissions; payer requests arrive by polling; ValidationError: Claim or authorization reference is required; ValidationError (dynamic detail; inspect source); ValidationError: Communication payload or attachment is required; ValidationError: The inbound NPHIES communication has no business identifier; PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

nphies_payment_notice · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/nphies-payment-notice/ — action nphies_payment_notice. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body payment_reconciliation not declared at read site not established
body payment_notice not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_write_invoice_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: NPHIES payment notices must reference a canonical RCM payment_notice, not a legacy payment_reconciliation with a manually edited bank receipt timestamp.; ValidationError: Canonical payment_notice must be submitted before NPHIES delivery; ValidationError: A payment notice has already been queued for this reconciliation; PermissionDenied: Cannot submit or adjudicate claims; PermissionDenied: Cannot read revenue-cycle records.

nphies_support · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/nphies-support/ — action nphies_support. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body operation not declared at read site not established
body reason_code not declared at read site not established
body exchange not declared at read site not established
body count not declared at read site not established
body include_message_types not declared at read site not established
body exclude_message_types not declared at read site not established
body period not declared at read site not established
body message_types not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: operation must be poll, status, cancel, or retry; ValidationError (dynamic detail; inspect source); ValidationError: Only failed or blocked exchanges can be retried; ValidationError: NPHIES status and cancellation requests apply only to claims; PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

estimate · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/estimate/ — action estimate. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body id not declared at read site direct indexing; validation may be upstream
body acknowledge not declared at read site not established
body deposit_received not declared at read site direct indexing; validation may be upstream
body lines not declared at read site not established
body present not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Estimate requires planned service lines or captured charges; ValidationError: Only a fully priced, presented estimate can be acknowledged; PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

authorization · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/authorization/ — action authorization. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body id not declared at read site direct indexing; validation may be upstream
body acknowledge_patient_responsibility not declared at read site not established
body status not declared at read site not established
body parent_authorization not declared at read site direct indexing; validation may be upstream
body submit not declared at read site not established
body services not declared at read site not established
body authorization_type not declared at read site not established
body urgency not declared at read site not established
body requested_amount not declared at read site not established
body clinical_information not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Coverage is required for prior authorization; ValidationError: Patient responsibility can only be acknowledged after a partial approval or denial; ValidationError: Payer authorization decisions must arrive through NPHIES; ValidationError: Only a payer-adjudicated authorization can be amended; ValidationError: An authorization amendment must include the complete requested service set; ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

Conditional gates: requested_status in conditional/computed expression; inspect pinned declaration and not settings.DEBUG.

utilization_review · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/utilization_review/ — action utilization_review. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body id not declared at read site direct indexing; validation may be upstream
query {computed field name} not declared at read site not established

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

charge_audit · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/charge_audit/ — action charge_audit. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body late_charges not declared at read site direct indexing; validation may be upstream
body expected_services not declared at read site not established
body status not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

coding · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/coding/ — action coding. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
query {computed field name} not declared at read site not established

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

build_claim · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/build_claim/ — action build_claim. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body invoice not declared at read site direct indexing; validation may be upstream
body prior_claim not declared at read site direct indexing; validation may be upstream
body supporting_information not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_write_invoice_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot submit or adjudicate claims; PermissionDenied: Cannot read revenue-cycle records.

submit_claim · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/submit_claim/ — action submit_claim. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body claim not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_write_invoice_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 202. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot submit or adjudicate claims; PermissionDenied: Cannot read revenue-cycle records.

adjudicate · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/adjudicate/ — action adjudicate. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body status not declared at read site not established
body outcome not declared at read site not established
body allowed_amount not declared at read site not established
body patient_responsibility not declared at read site not established
body payer_claim_reference not declared at read site not established
body line_adjudication not declared at read site not established
body denials not declared at read site not established
body claim not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_write_invoice_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Payer claim adjudication must arrive through NPHIES; ValidationError: Claim paid_amount is posted only by canonical RCM cash settlement; adjudication cannot assert bank cash.; PermissionDenied: Cannot submit or adjudicate claims; PermissionDenied: Cannot read revenue-cycle records.

Conditional gates: not settings.DEBUG.

remittance · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/remittance/ — action remittance. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
query {computed field name} not declared at read site not established

Observed authorization checks: can_write_invoice_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Legacy case remittance posting is disabled. Payer advice, bank cash, settlement, reversals and payment notices must use the canonical RCM finance endpoints so advice is never treated as cash and bank receipts are ledgered before claim paid balances move.; PermissionDenied: Cannot submit or adjudicate claims; PermissionDenied: Cannot read revenue-cycle records.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

denial · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/denial/ — action denial. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body action not declared at read site not established
body id not declared at read site not established
body rationale not declared at read site not established
body attachments not declared at read site not established
body root_cause not declared at read site not established
body description not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_write_invoice_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Unsupported denial action; PermissionDenied: Cannot submit or adjudicate claims; PermissionDenied: Cannot read revenue-cycle records.

collection · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/collection/ — action collection. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body id not declared at read site direct indexing; validation may be upstream
body invoice not declared at read site direct indexing; validation may be upstream
query {computed field name} not declared at read site not established

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

work_item · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/work_item/ — action work_item. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body id not declared at read site direct indexing; validation may be upstream
body status not declared at read site not established
body resolution not declared at read site not established
body stage not declared at read site not established
body work_type not declared at read site not established
body priority not declared at read site not established
body title not declared at read site direct indexing; validation may be upstream
body description not declared at read site not established
body due_at not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

transition · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/transition/ — action transition. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body status not declared at read site not established
body reason not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Back-office claim, remittance, denial and collection controls must be complete; ValidationError: Resolve all denials before closing the case; ValidationError: Account balance must be settled before closing; ValidationError: Unsupported revenue-cycle status transition; PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

prepare_insured_visit · POST

Reserve a sourced visit; never authorize an invoice or claim.

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/prepare-insured-visit/ — action prepare_insured_visit. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body event_key not declared at read site not established
body expires_at not declared at read site not established
body supersedes_id not declared at read site not established
body correction_reason not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_prepare_rcm_visit_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: expires_at must be a timezone-aware ISO datetime; ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot prepare insured financial visits; PermissionDenied: Cannot read revenue-cycle records.

commit_insured_visit · POST

Commit the unchanged financial snapshot for tax and claim stages.

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/commit-insured-visit/ — action commit_insured_visit. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
body preparation_id not declared at read site not established
body commitment_key not declared at read site not established
query {computed field name} not declared at read site not established

Observed authorization checks: can_prepare_rcm_visit_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: preparation_id is required; ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot prepare insured financial visits; PermissionDenied: Cannot read revenue-cycle records.

recalculate · POST

POST /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/recalculate/ — action recalculate. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
query {computed field name} not declared at read site not established

Observed authorization checks: can_update_account_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot update revenue-cycle records; PermissionDenied: Cannot read revenue-cycle records.

audit · GET

GET /api/v1/facility/{facility_external_id}/revenue_cycle/{external_id}/audit/ — action audit. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location Parameter Type Required
path facility_external_id router lookup string; semantic ID validation requires handler/schema review true
path external_id router lookup string; semantic ID validation requires handler/schema review true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location Field Declared/inferred read type Requiredness evidence
query {computed field name} not declared at read site not established

Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.

Integration review checklist

Confirm the installed route and full schema; review authentication, organization/facility scoping, all accepted fields, value-state and date/time semantics, idempotency, pagination, response/exception branches and the allowed correction/reversal workflow. Test positive and negative cases with synthetic data. This source reference does not establish external certification or replace an illustrated user procedure.

Pinned source evidence

Links require access to the private source repository.