Backend resource · STATIC DECLARATIONS

In App Notification API reference · mansoq-notifications-be

Static source contract for In App Notification: 4 declared or inherited operation mappings, schema/field evidence and authorization/refusal references. Deployment and behavioral review remain explicit.

Static API contract — behavior review pending. Source baseline f6e9f05f76d4.

Enable JavaScript to inspect structured operation, parameter, schema and permission evidence. Download this reference and its evidence.

Declared route and availability

This resource is declared in mansoq-notifications-be at /api/{installed_plugin_prefix}/in_app_notifications/. plugin/local mount; actual prefix and enablement require deployment verification A registered path and an indexed handler do not prove deployment availability, user permission or production readiness.

Operation map

Method	Path	Action	Evidence
GET	`/api/{installed_plugin_prefix}/in_app_notifications/`	list	declared/inherited method
GET	`/api/{installed_plugin_prefix}/in_app_notifications/{external_id}/`	retrieve	declared/inherited method
POST	`/api/{installed_plugin_prefix}/in_app_notifications/mark_read/`	mark_read	@action declaration
POST	`/api/{installed_plugin_prefix}/in_app_notifications/mark_unread/`	mark_unread	@action declaration

list · GET

GET /api/{installed_plugin_prefix}/in_app_notifications/ — action list. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
deployment mount	installed_plugin_prefix	deployment-selected mount prefix	true

response: InAppNotificationListSpec. Declared fields below; inherited fields are retained in the schema inventory.

Field	Type	Required	Constraints
meta	dict	false	No extra constraint extracted
id	UUID4 \| None	false	No extra constraint extracted
event_type	str	true	No extra constraint extracted
resource_type	str	true	No extra constraint extracted
resource_id	UUID4	true	No extra constraint extracted
facility_id	UUID4 \| None	false	No extra constraint extracted
title	str	true	No extra constraint extracted
body	str	false	No extra constraint extracted
payload	dict[str, Any]	false	No extra constraint extracted
read_at	datetime.datetime \| None	false	No extra constraint extracted
created_date	datetime.datetime	true	No extra constraint extracted
modified_date	datetime.datetime	true	No extra constraint extracted
recipient	dict \| None	false	No extra constraint extracted

Observed authorization checks: can_list_all_notifications. Helper/queryset evidence is included; this is not proof of complete security review.

Class policy declarations: permission_classes: IsAuthenticated.

retrieve · GET

GET /api/{installed_plugin_prefix}/in_app_notifications/{external_id}/ — action retrieve. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
deployment mount	installed_plugin_prefix	deployment-selected mount prefix	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

response: InAppNotificationRetrieveSpec. Declared fields below; inherited fields are retained in the schema inventory.

Field	Type	Required	Constraints
meta	dict	false	No extra constraint extracted
id	UUID4 \| None	false	No extra constraint extracted
event_type	str	true	No extra constraint extracted
resource_type	str	true	No extra constraint extracted
resource_id	UUID4	true	No extra constraint extracted
facility_id	UUID4 \| None	false	No extra constraint extracted
title	str	true	No extra constraint extracted
body	str	false	No extra constraint extracted
payload	dict[str, Any]	false	No extra constraint extracted
read_at	datetime.datetime \| None	false	No extra constraint extracted
created_date	datetime.datetime	true	No extra constraint extracted
modified_date	datetime.datetime	true	No extra constraint extracted
recipient	dict \| None	false	No extra constraint extracted

Observed authorization checks: can_list_all_notifications. Helper/queryset evidence is included; this is not proof of complete security review.

Class policy declarations: permission_classes: IsAuthenticated.

mark_read · POST

POST /api/{installed_plugin_prefix}/in_app_notifications/mark_read/ — action mark_read. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
deployment mount	installed_plugin_prefix	deployment-selected mount prefix	true

body validation: InAppNotificationMarkReadRequest. Declared fields below; inherited fields are retained in the schema inventory.

Field	Type	Required	Constraints
ids	list[UUID4]	true	min_length: 1

Observed authorization checks: can_list_all_notifications. Helper/queryset evidence is included; this is not proof of complete security review.

Class policy declarations: permission_classes: IsAuthenticated.

mark_unread · POST

POST /api/{installed_plugin_prefix}/in_app_notifications/mark_unread/ — action mark_unread. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
deployment mount	installed_plugin_prefix	deployment-selected mount prefix	true

body validation: InAppNotificationMarkReadRequest. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

Observed authorization checks: can_list_all_notifications. Helper/queryset evidence is included; this is not proof of complete security review.

Class policy declarations: permission_classes: IsAuthenticated.

Integration review checklist

Confirm the installed route and full schema; review authentication, organization/facility scoping, all accepted fields, value-state and date/time semantics, idempotency, pagination, response/exception branches and the allowed correction/reversal workflow. Test positive and negative cases with synthetic data. This source reference does not establish external certification or replace an illustrated user procedure.

Pinned source evidence

Links require access to the private source repository.