Backend resource · STATIC DECLARATIONS

Source Evidence API reference · mansoq-core

Static source contract for Source Evidence: 5 declared or inherited operation mappings, schema/field evidence and authorization/refusal references. Deployment and behavioral review remain explicit.

Static API contract — behavior review pending. Source baseline f6e9f05f76d4.

Enable JavaScript to inspect structured operation, parameter, schema and permission evidence. Download this reference and its evidence.

Declared route and availability

This resource is declared in mansoq-core at /api/v1/facility/{facility_external_id}/rcm/source_evidence/. verified core mount in config/urls.py A registered path and an indexed handler do not prove deployment availability, user permission or production readiness.

Upload once; another authorized operator verifies bytes before activation.

Corrections are a new register/version. No update or delete route can silently replace the bytes backing an already-published contractual rule.

Operation map

Method	Path	Action	Evidence
GET	`/api/v1/facility/{facility_external_id}/rcm/source_evidence/`	list	declared/inherited method
POST	`/api/v1/facility/{facility_external_id}/rcm/source_evidence/`	create	declared/inherited method
GET	`/api/v1/facility/{facility_external_id}/rcm/source_evidence/{external_id}/`	retrieve	declared/inherited method
GET	`/api/v1/facility/{facility_external_id}/rcm/source_evidence/{external_id}/download/`	download	@action declaration
POST	`/api/v1/facility/{facility_external_id}/rcm/source_evidence/{external_id}/verify/`	verify	@action declaration

list · GET

GET /api/v1/facility/{facility_external_id}/rcm/source_evidence/ — action list. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
query	`is_activation_grade`	not declared at read site	not established
query	`as_of`	not declared at read site	not established

Authorization: no literal permission name was resolved in the bounded handler/helper traversal. Authentication, inherited policies, object/facility scoping and middleware still require review; this does not mean public access.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source).

create · POST

POST /api/v1/facility/{facility_external_id}/rcm/source_evidence/ — action create. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
file	`file`	not declared at read site	not established
body	`applicable_population`	not declared at read site	not established
body	`unresolved_interpretation`	not declared at read site	not established
body	`register_id`	not declared at read site	direct indexing; validation may be upstream
body	`authority`	not declared at read site	direct indexing; validation may be upstream
body	`title`	not declared at read site	direct indexing; validation may be upstream
body	`document_version`	not declared at read site	direct indexing; validation may be upstream
body	`url`	not declared at read site	not established
body	`{computed field name}`	not declared at read site	not established
query	`is_activation_grade`	not declared at read site	not established
query	`as_of`	not declared at read site	not established

Observed authorization checks: can_edit_rcm_configuration_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: 201. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot edit RCM configuration.

retrieve · GET

GET /api/v1/facility/{facility_external_id}/rcm/source_evidence/{external_id}/ — action retrieve. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
query	`is_activation_grade`	not declared at read site	not established
query	`as_of`	not declared at read site	not established

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source).

download · GET

GET /api/v1/facility/{facility_external_id}/rcm/source_evidence/{external_id}/download/ — action download. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
query	`is_activation_grade`	not declared at read site	not established

Observed authorization checks: can_read_rcm_configuration_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Source has no stored evidence file; ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot read RCM configuration.

verify · POST

POST /api/v1/facility/{facility_external_id}/rcm/source_evidence/{external_id}/verify/ — action verify. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
body	`mfa_code`	not declared at read site	not established
body	`reviewed_contents`	not declared at read site	not established
body	`review_note`	not declared at read site	not established
query	`is_activation_grade`	not declared at read site	not established
query	`as_of`	not declared at read site	not established

Observed authorization checks: can_publish_rcm_configuration_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: Source document was not found in this facility; ValidationError: Source was already independently verified; ValidationError: Source has no stored content and digest; ValidationError: Independent reviewer must inspect the document and provide a review note; ValidationError: Unresolved source interpretation must be resolved in a new source version; ValidationError: Stored evidence exceeds the source size limit; ValidationError: Stored evidence does not match its recorded SHA-256; ValidationError: Uploader cannot verify their own evidence under delegated review; ValidationError: Stored evidence is unavailable; it cannot be approved; ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot approve, activate or publish RCM configuration.

Integration review checklist

Confirm the installed route and full schema; review authentication, organization/facility scoping, all accepted fields, value-state and date/time semantics, idempotency, pagination, response/exception branches and the allowed correction/reversal workflow. Test positive and negative cases with synthetic data. This source reference does not establish external certification or replace an illustrated user procedure.

Pinned source evidence

Links require access to the private source repository.