Backend resource · STATIC DECLARATIONS

Zatca Document API reference · mansoq-core

Static source contract for Zatca Document: 10 declared or inherited operation mappings, schema/field evidence and authorization/refusal references. Deployment and behavioral review remain explicit.

Static API contract — behavior review pending. Source baseline f6e9f05f76d4.

Enable JavaScript to inspect structured operation, parameter, schema and permission evidence. Download this reference and its evidence.

Declared route and availability

This resource is declared in mansoq-core at /api/v1/facility/{facility_external_id}/rcm/zatca_documents/. verified core mount in config/urls.py A registered path and an indexed handler do not prove deployment availability, user permission or production readiness.

Operate generated ZATCA documents without inventing clearance.

Operation map

Method	Path	Action	Evidence
GET	`/api/v1/facility/{facility_external_id}/rcm/zatca_documents/`	list	declared/inherited method
GET	`/api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/`	retrieve	declared/inherited method
POST	`/api/v1/facility/{facility_external_id}/rcm/zatca_documents/ensure-for-invoice/`	ensure_for_invoice	@action declaration
POST	`/api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/sign/`	sign	@action declaration
POST	`/api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/submit/`	submit	@action declaration
POST	`/api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/clear/`	clear	@action declaration
POST	`/api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/report/`	report	@action declaration
POST	`/api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/reject/`	reject	@action declaration
POST	`/api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/regenerate/`	regenerate	@action declaration
POST	`/api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/dispatch/`	dispatch_next_operation	@action declaration

list · GET

GET /api/v1/facility/{facility_external_id}/rcm/zatca_documents/ — action list. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
query	`invoice`	not declared at read site	not established
query	`{computed field name}`	not declared at read site	not established

Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.

retrieve · GET

GET /api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/ — action retrieve. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
query	`invoice`	not declared at read site	not established
query	`{computed field name}`	not declared at read site	not established

Observed authorization checks: can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: PermissionDenied: Cannot read revenue-cycle records.

ensure_for_invoice · POST

Create the tax determination and first local document for an invoice.

POST /api/v1/facility/{facility_external_id}/rcm/zatca_documents/ensure-for-invoice/ — action ensure_for_invoice. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
query	`invoice`	not declared at read site	not established
query	`{computed field name}`	not declared at read site	not established

Observed authorization checks: can_manage_rcm_claims_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot submit, adjudicate or settle claims; ValidationError: Request body must be an object; PermissionDenied: Cannot read revenue-cycle records.

sign · POST

POST /api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/sign/ — action sign. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
query	`invoice`	not declared at read site	not established
query	`{computed field name}`	not declared at read site	not established

Observed authorization checks: can_manage_rcm_claims_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError: ZATCA_UNVERIFIED_REFERENCE_NOT_ACCEPTED; Use the verified FATOORA invoice workflow. A typed reference cannot establish a government outcome.; PermissionDenied: Cannot submit, adjudicate or settle claims; PermissionDenied: Cannot read revenue-cycle records.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

submit · POST

POST /api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/submit/ — action submit. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
query	`invoice`	not declared at read site	not established
query	`{computed field name}`	not declared at read site	not established

Observed authorization checks: can_manage_rcm_claims_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

clear · POST

POST /api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/clear/ — action clear. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
query	`invoice`	not declared at read site	not established
query	`{computed field name}`	not declared at read site	not established

Observed authorization checks: can_manage_rcm_claims_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

report · POST

POST /api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/report/ — action report. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
query	`invoice`	not declared at read site	not established
query	`{computed field name}`	not declared at read site	not established

Observed authorization checks: can_manage_rcm_claims_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

reject · POST

POST /api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/reject/ — action reject. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
query	`invoice`	not declared at read site	not established
query	`{computed field name}`	not declared at read site	not established

Observed authorization checks: can_manage_rcm_claims_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Direct refusal present: the handler/helper contains a top-level raise. Review whether the operation is intentionally disabled or only performs validation before relying on it.

regenerate · POST

POST /api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/regenerate/ — action regenerate. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
query	`invoice`	not declared at read site	not established
query	`{computed field name}`	not declared at read site	not established

Observed authorization checks: can_read_account_in_facility, can_manage_rcm_claims_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot read revenue-cycle records; PermissionDenied: Cannot submit, adjudicate or settle claims.

dispatch_next_operation · POST

Run the next automated ZATCA operation for this document.

POST /api/v1/facility/{facility_external_id}/rcm/zatca_documents/{external_id}/dispatch/ — action dispatch_next_operation. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Location	Field	Declared/inferred read type	Requiredness evidence
query	`invoice`	not declared at read site	not established
query	`{computed field name}`	not declared at read site	not established

Observed authorization checks: can_manage_rcm_claims_in_facility, can_read_account_in_facility. Helper/queryset evidence is included; this is not proof of complete security review.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied: Cannot submit, adjudicate or settle claims; PermissionDenied: Cannot read revenue-cycle records.

Integration review checklist

Confirm the installed route and full schema; review authentication, organization/facility scoping, all accepted fields, value-state and date/time semantics, idempotency, pagination, response/exception branches and the allowed correction/reversal workflow. Test positive and negative cases with synthetic data. This source reference does not establish external certification or replace an illustrated user procedure.

Pinned source evidence

Links require access to the private source repository.