MANSOQ Backend resource · STATIC DECLARATIONS
Token Booking API reference · mansoq-core
Static source contract for Token Booking: 10 declared or inherited operation mappings, schema/field evidence and authorization/refusal references. Deployment and behavioral review remain explicit.
Static API contract — behavior review pending. Source baseline f6e9f05f76d4.
Enable JavaScript to inspect structured operation, parameter, schema and permission evidence. Download this reference and its evidence.
Declared route and availability
This resource is declared in mansoq-core at /api/v1/facility/{facility_external_id}/appointments/. verified core mount in config/urls.py A registered path and an indexed handler do not prove deployment availability, user permission or production readiness.
Operation map
| Method | Path | Action | Evidence |
|---|---|---|---|
| GET | /api/v1/facility/{facility_external_id}/appointments/ |
list | declared/inherited method |
| GET | /api/v1/facility/{facility_external_id}/appointments/{external_id}/ |
retrieve | declared/inherited method |
| PUT | /api/v1/facility/{facility_external_id}/appointments/{external_id}/ |
update | declared/inherited method |
| PATCH | /api/v1/facility/{facility_external_id}/appointments/{external_id}/ |
partial_update | declared/inherited method |
| POST | /api/v1/facility/{facility_external_id}/appointments/{external_id}/set_tags/ |
set_tags | @action declaration |
| POST | /api/v1/facility/{facility_external_id}/appointments/{external_id}/remove_tags/ |
remove_tags | @action declaration |
| POST | /api/v1/facility/{facility_external_id}/appointments/{external_id}/cancel/ |
cancel | @action declaration |
| POST | /api/v1/facility/{facility_external_id}/appointments/{external_id}/reschedule/ |
reschedule | @action declaration |
| GET | /api/v1/facility/{facility_external_id}/appointments/available_users/ |
available_users | @action declaration |
| POST | /api/v1/facility/{facility_external_id}/appointments/{external_id}/generate_token/ |
generate_token | @action declaration |
list · GET
GET /api/v1/facility/{facility_external_id}/appointments/ — action list. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | organization_ids |
not declared at read site | not established |
| query | resource_ids |
not declared at read site | not established |
| query | resource_type |
not declared at read site | direct indexing; validation may be upstream |
response: TokenBookingReadSpec. Declared fields below; inherited fields are retained in the schema inventory.
| Field | Type | Required | Constraints |
|---|---|---|---|
| meta | dict | false | No extra constraint extracted |
| id | UUID4 | None | false | No extra constraint extracted |
| token_slot | TokenSlotBaseSpec | true | No extra constraint extracted |
| booked_on | datetime.datetime | true | No extra constraint extracted |
| booked_by | UserSpec | true | No extra constraint extracted |
| status | str | true | No extra constraint extracted |
| note | str | true | No extra constraint extracted |
| resource_type | SchedulableResourceTypeOptions | true | No extra constraint extracted |
| resource | dict | false | No extra constraint extracted |
| facility | dict | false | No extra constraint extracted |
| created_by | UserSpec | None | false | No extra constraint extracted |
| updated_by | UserSpec | None | false | No extra constraint extracted |
| created_date | datetime.datetime | true | No extra constraint extracted |
| modified_date | datetime.datetime | true | No extra constraint extracted |
| token | TokenReadSpec | None | false | No extra constraint extracted |
| tags | list[dict] | false | No extra constraint extracted |
| charge_item | dict | None | false | No extra constraint extracted |
| patient | PatientRetrieveSpec | true | No extra constraint extracted |
Authorization: no literal permission name was resolved in the bounded handler/helper traversal. Authentication, inherited policies, object/facility scoping and middleware still require review; this does not mean public access.
Declared refusal/error evidence: ValidationError: Resource Type is required.
retrieve · GET
GET /api/v1/facility/{facility_external_id}/appointments/{external_id}/ — action retrieve. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | organization_ids |
not declared at read site | not established |
| query | resource_ids |
not declared at read site | not established |
| query | resource_type |
not declared at read site | direct indexing; validation may be upstream |
response: TokenBookingRetrieveSpec. Declared fields below; inherited fields are retained in the schema inventory.
| Field | Type | Required | Constraints |
|---|---|---|---|
| meta | dict | false | No extra constraint extracted |
| id | UUID4 | None | false | No extra constraint extracted |
| token_slot | TokenSlotBaseSpec | true | No extra constraint extracted |
| booked_on | datetime.datetime | true | No extra constraint extracted |
| booked_by | UserSpec | true | No extra constraint extracted |
| status | str | true | No extra constraint extracted |
| note | str | true | No extra constraint extracted |
| resource_type | SchedulableResourceTypeOptions | true | No extra constraint extracted |
| resource | dict | false | No extra constraint extracted |
| facility | dict | false | No extra constraint extracted |
| created_by | UserSpec | None | false | No extra constraint extracted |
| updated_by | UserSpec | None | false | No extra constraint extracted |
| created_date | datetime.datetime | true | No extra constraint extracted |
| modified_date | datetime.datetime | true | No extra constraint extracted |
| token | TokenReadSpec | None | false | No extra constraint extracted |
| tags | list[dict] | false | No extra constraint extracted |
| charge_item | dict | None | false | No extra constraint extracted |
| patient | PatientRetrieveSpec | true | No extra constraint extracted |
| associated_encounter | dict | false | No extra constraint extracted |
Observed authorization checks: can_list_booking. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: ValidationError: Resource Type is required; PermissionDenied: You do not have permission to retrieve bookings.
update · PUT
PUT /api/v1/facility/{facility_external_id}/appointments/{external_id}/ — action update. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | organization_ids |
not declared at read site | not established |
| query | resource_ids |
not declared at read site | not established |
| query | resource_type |
not declared at read site | direct indexing; validation may be upstream |
request: TokenBookingWriteSpec. Declared fields below; inherited fields are retained in the schema inventory.
| Field | Type | Required | Constraints |
|---|---|---|---|
| meta | dict | false | No extra constraint extracted |
| status | BookingStatusChoices | true | No extra constraint extracted |
| note | str | true | No extra constraint extracted |
response: TokenBookingRetrieveSpec. Declared fields below; inherited fields are retained in the schema inventory.
The declared field table is shown at its first occurrence in this reference; this operation links the same schema.
Observed authorization checks: can_write_booking. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: ValidationError: Resource Type is required; PermissionDenied: You do not have permission to update bookings.
partial_update · PATCH
PATCH /api/v1/facility/{facility_external_id}/appointments/{external_id}/ — action partial_update. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | organization_ids |
not declared at read site | not established |
| query | resource_ids |
not declared at read site | not established |
| query | resource_type |
not declared at read site | direct indexing; validation may be upstream |
request: TokenBookingWriteSpec. Declared fields below; inherited fields are retained in the schema inventory.
The declared field table is shown at its first occurrence in this reference; this operation links the same schema.
response: TokenBookingRetrieveSpec. Declared fields below; inherited fields are retained in the schema inventory.
The declared field table is shown at its first occurrence in this reference; this operation links the same schema.
Observed authorization checks: can_write_booking. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: ValidationError: Resource Type is required; PermissionDenied: You do not have permission to update bookings.
set_tags · POST
POST /api/v1/facility/{facility_external_id}/appointments/{external_id}/set_tags/ — action set_tags. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | organization_ids |
not declared at read site | not established |
| query | resource_ids |
not declared at read site | not established |
| query | resource_type |
not declared at read site | direct indexing; validation may be upstream |
decorator request: TagRequest. Declared fields below; inherited fields are retained in the schema inventory.
| Field | Type | Required | Constraints |
|---|---|---|---|
| tags | list[UUID4] | false | No extra constraint extracted |
Observed authorization checks: can_write_booking, can_list_booking. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: ValidationError: Resource Type is required; RestFrameworkValidationError (dynamic detail; inspect source); PermissionDenied: You do not have permission to update bookings; PermissionDenied: You do not have permission to retrieve bookings.
remove_tags · POST
POST /api/v1/facility/{facility_external_id}/appointments/{external_id}/remove_tags/ — action remove_tags. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | organization_ids |
not declared at read site | not established |
| query | resource_ids |
not declared at read site | not established |
| query | resource_type |
not declared at read site | direct indexing; validation may be upstream |
body validation: TagRequest. Declared fields below; inherited fields are retained in the schema inventory.
The declared field table is shown at its first occurrence in this reference; this operation links the same schema.
decorator request: TagRequest. Declared fields below; inherited fields are retained in the schema inventory.
The declared field table is shown at its first occurrence in this reference; this operation links the same schema.
Observed authorization checks: can_write_booking, can_list_booking. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: ValidationError: Resource Type is required; PermissionDenied: You do not have permission to update bookings; PermissionDenied: You do not have permission to retrieve bookings.
cancel · POST
POST /api/v1/facility/{facility_external_id}/appointments/{external_id}/cancel/ — action cancel. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | organization_ids |
not declared at read site | not established |
| query | resource_ids |
not declared at read site | not established |
| query | resource_type |
not declared at read site | direct indexing; validation may be upstream |
Observed authorization checks: can_write_booking. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: ValidationError: Resource Type is required; PermissionDenied: You do not have permission to update bookings; ValidationError: You cannot cancel an appointment In-Consultation.
reschedule · POST
POST /api/v1/facility/{facility_external_id}/appointments/{external_id}/reschedule/ — action reschedule. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | organization_ids |
not declared at read site | not established |
| query | resource_ids |
not declared at read site | not established |
| query | resource_type |
not declared at read site | direct indexing; validation may be upstream |
decorator request: RescheduleBookingSpec. Declared fields below; inherited fields are retained in the schema inventory.
| Field | Type | Required | Constraints |
|---|---|---|---|
| new_slot | UUID4 | true | No extra constraint extracted |
| new_booking_note | str | true | No extra constraint extracted |
| previous_booking_note | str | None | false | No extra constraint extracted |
| tags | list[UUID4] | false | No extra constraint extracted |
Observed authorization checks: can_reschedule_booking, can_write_booking. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: PermissionDenied: You do not have permission to reschedule appointments; ValidationError: Cannot reschedule to the same slot; ValidationError: Resource Type is required; PermissionDenied: You do not have permission to update bookings; ValidationError: You cannot cancel an appointment In-Consultation.
available_users · GET
GET /api/v1/facility/{facility_external_id}/appointments/available_users/ — action available_users. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | organization_ids |
not declared at read site | not established |
| query | resource_ids |
not declared at read site | not established |
| query | resource_type |
not declared at read site | direct indexing; validation may be upstream |
Authorization: no literal permission name was resolved in the bounded handler/helper traversal. Authentication, inherited policies, object/facility scoping and middleware still require review; this does not mean public access.
Declared refusal/error evidence: ValidationError: Resource Type is required.
generate_token · POST
POST /api/v1/facility/{facility_external_id}/appointments/{external_id}/generate_token/ — action generate_token. static contract extracted; runtime/permission/payload behavior review pending.
Path and deployment-context parameters:
| Location | Parameter | Type | Required |
|---|---|---|---|
| path | facility_external_id | router lookup string; semantic ID validation requires handler/schema review | true |
| path | external_id | router lookup string; semantic ID validation requires handler/schema review | true |
Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):
| Location | Field | Declared/inferred read type | Requiredness evidence |
|---|---|---|---|
| query | organization_ids |
not declared at read site | not established |
| query | resource_ids |
not declared at read site | not established |
| query | resource_type |
not declared at read site | direct indexing; validation may be upstream |
decorator request: TokenGenerationSpec. Declared fields below; inherited fields are retained in the schema inventory.
| Field | Type | Required | Constraints |
|---|---|---|---|
| category | UUID4 | true | No extra constraint extracted |
| note | str | None | false | No extra constraint extracted |
| queue | UUID4 | None | false | No extra constraint extracted |
Observed authorization checks: can_write_booking. Helper/queryset evidence is included; this is not proof of complete security review.
Declared refusal/error evidence: ValidationError: Token already generated; ValidationError: Category not found; ValidationError: Queue not found; ValidationError: Resource Type is required; PermissionDenied: You do not have permission to update bookings.
Integration review checklist
Confirm the installed route and full schema; review authentication, organization/facility scoping, all accepted fields, value-state and date/time semantics, idempotency, pagination, response/exception branches and the allowed correction/reversal workflow. Test positive and negative cases with synthetic data. This source reference does not establish external certification or replace an illustrated user procedure.
Pinned source evidence
Links require access to the private source repository.
- repositories/platform/mansoq-core/config/api_router.py:353
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/scheduling/booking.py:89
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:168
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/scheduling/booking.py:139
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:161
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/scheduling/booking.py:113
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:330
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:158
- repositories/platform/mansoq-core/mansoq/emr/resources/scheduling/slot/spec.py:154
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:83
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/scheduling/booking.py:130
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:325
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:77
- repositories/platform/mansoq-core/mansoq/emr/resources/scheduling/slot/spec.py:165
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:214
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/scheduling/booking.py:121
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:228
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:201
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:335
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:346
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:180
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:222
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:352
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:349
- repositories/platform/mansoq-core/mansoq/emr/resources/scheduling/slot/spec.py:80
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:218
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:394
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:386
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:372
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/scheduling/booking.py:118
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:360
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:405
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/base.py:389
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/scheduling/booking.py:201
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/scheduling/booking.py:180
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/scheduling/booking.py:213
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/scheduling/booking.py:72
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/scheduling/booking.py:259
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/scheduling/booking.py:290
- repositories/platform/mansoq-core/mansoq/emr/api/viewsets/scheduling/booking.py:66