Cash Session API reference · mansoq-odoo-be

Declared route and availability

This resource is declared in mansoq-odoo-be at /api/{installed_plugin_prefix}/cash-session/. plugin/local mount; actual prefix and enablement require deployment verification A registered path and an indexed handler do not prove deployment availability, user permission or production readiness.

ViewSet for managing cash sessions with Odoo.

All endpoints are facility-scoped and use the authenticated user.

URL Pattern: /facility/{facility_external_id}/cash-session/

Endpoints:

• POST / - Open a new session
• PUT /close/ - Close current session
• GET /current/ - Get current session for authenticated user at location
• GET / - List sessions
• GET /counters/ - List all counters with session status

Operation map

list · GET

List all sessions in the facility, optionally filtered by status.

GET /facility/{facility_external_id}/cash-session/?status=open

GET /api/{installed_plugin_prefix}/cash-session/ — action list. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Authorization: no literal permission name was resolved in the bounded handler/helper traversal. Authentication, inherited policies, object/facility scoping and middleware still require review; this does not mean public access.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source).

create · POST

Open a new cash session for the authenticated user.

POST /facility/{facility_external_id}/cash-session/ { "counter_x_care_id": "UUID", "opening_balance": 5000.00 }

POST /api/{installed_plugin_prefix}/cash-session/ — action create. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Observed authorization checks: can_list_facility_location_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_201_CREATED. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied (dynamic detail; inspect source); NotFound (dynamic detail; inspect source).

close_session · PUT

Close the current cash session for the authenticated user.

PUT /facility/{facility_external_id}/cash-session/close/ { "counter_x_care_id": "UUID", "declared_amount": 45000.00, "denominations": {"500": 50, "200": 100} }

PUT /api/{installed_plugin_prefix}/cash-session/close/ — action close_session. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Observed authorization checks: can_list_facility_location_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied (dynamic detail; inspect source); NotFound (dynamic detail; inspect source).

close_session · POST

Close the current cash session for the authenticated user.

PUT /facility/{facility_external_id}/cash-session/close/ { "counter_x_care_id": "UUID", "declared_amount": 45000.00, "denominations": {"500": 50, "200": 100} }

POST /api/{installed_plugin_prefix}/cash-session/close/ — action close_session. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Observed authorization checks: can_list_facility_location_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied (dynamic detail; inspect source); NotFound (dynamic detail; inspect source).

current_session · POST

Get the current open session for the authenticated user at a location.

POST /facility/{facility_external_id}/cash-session/current/ { "counter_x_care_id": "UUID" }

POST /api/{installed_plugin_prefix}/cash-session/current/ — action current_session. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_list_facility_location_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: counter_x_care_id is required; ValidationError (dynamic detail; inspect source); PermissionDenied (dynamic detail; inspect source); NotFound (dynamic detail; inspect source).

list_counters · GET

List all available counters in the facility with their session status.

GET /facility/{facility_external_id}/cash-session/counters/

GET /api/{installed_plugin_prefix}/cash-session/counters/ — action list_counters. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Authorization: no literal permission name was resolved in the bounded handler/helper traversal. Authentication, inherited policies, object/facility scoping and middleware still require review; this does not mean public access.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source).

Integration review checklist

Confirm the installed route and full schema; review authentication, organization/facility scoping, all accepted fields, value-state and date/time semantics, idempotency, pagination, response/exception branches and the allowed correction/reversal workflow. Test positive and negative cases with synthetic data. This source reference does not establish external certification or replace an illustrated user procedure.