Cash Transfer API reference · mansoq-odoo-be

Declared route and availability

This resource is declared in mansoq-odoo-be at /api/{installed_plugin_prefix}/cash-transfer/. plugin/local mount; actual prefix and enablement require deployment verification A registered path and an indexed handler do not prove deployment availability, user permission or production readiness.

ViewSet for managing cash transfers with Odoo.

All endpoints are facility-scoped and use the authenticated user.

URL Pattern: /facility/{facility_external_id}/cash-transfer/

Endpoints:

• GET / - List transfers (with optional filters)
• POST / - Create a new transfer
• PUT /{id}/accept/ - Accept a transfer
• PUT /{id}/reject/ - Reject a transfer
• PUT /{id}/cancel/ - Cancel a transfer (by sender)
• GET /pending/ - Get pending incoming transfers

Operation map

list · GET

List cash transfers for the facility with optional filters.

GET /facility/{facility_external_id}/cash-transfer/

Query Parameters:

• status: Filter by transfer status (pending, accepted, rejected)
• counter_x_care_id: Filter by counter (shows transfers to/from this counter)
• from_session_id: Filter by the originating session ID
• to_session_id: Filter by the destination session ID

GET /api/{installed_plugin_prefix}/cash-transfer/ — action list. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_list_facility_location_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied (dynamic detail; inspect source); NotFound (dynamic detail; inspect source).

create · POST

Create a new cash transfer from the authenticated user's session.

POST /facility/{facility_external_id}/cash-transfer/ { "from_counter_x_care_id": "UUID", "to_session_id": "UUID", "amount": 40000.00, "denominations": {"500": 50, "200": 75} }

POST /api/{installed_plugin_prefix}/cash-transfer/ — action create. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Observed authorization checks: can_list_facility_location_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_201_CREATED. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError (dynamic detail; inspect source); PermissionDenied (dynamic detail; inspect source); NotFound (dynamic detail; inspect source).

accept_transfer · PUT

Accept an incoming cash transfer.

PUT /facility/{facility_external_id}/cash-transfer/{id}/accept/ { "counter_x_care_id": "UUID", # The counter where user is accepting "session_id": "ID" # User's session ID (must match transfer's destination) }

PUT /api/{installed_plugin_prefix}/cash-transfer/{external_id}/accept/ — action accept_transfer. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Observed authorization checks: can_list_facility_location_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Transfer ID is required; ValidationError (dynamic detail; inspect source); PermissionDenied (dynamic detail; inspect source); NotFound (dynamic detail; inspect source).

accept_transfer · POST

Accept an incoming cash transfer.

PUT /facility/{facility_external_id}/cash-transfer/{id}/accept/ { "counter_x_care_id": "UUID", # The counter where user is accepting "session_id": "ID" # User's session ID (must match transfer's destination) }

POST /api/{installed_plugin_prefix}/cash-transfer/{external_id}/accept/ — action accept_transfer. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Observed authorization checks: can_list_facility_location_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Transfer ID is required; ValidationError (dynamic detail; inspect source); PermissionDenied (dynamic detail; inspect source); NotFound (dynamic detail; inspect source).

reject_transfer · PUT

Reject an incoming cash transfer.

PUT /facility/{facility_external_id}/cash-transfer/{id}/reject/ { "counter_x_care_id": "UUID", # The counter where user is rejecting "session_id": "ID", # User's session ID (must match transfer's destination) "reason": "Amount doesn't match" # Optional }

PUT /api/{installed_plugin_prefix}/cash-transfer/{external_id}/reject/ — action reject_transfer. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Observed authorization checks: can_list_facility_location_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Transfer ID is required; ValidationError (dynamic detail; inspect source); PermissionDenied (dynamic detail; inspect source); NotFound (dynamic detail; inspect source).

reject_transfer · POST

Reject an incoming cash transfer.

PUT /facility/{facility_external_id}/cash-transfer/{id}/reject/ { "counter_x_care_id": "UUID", # The counter where user is rejecting "session_id": "ID", # User's session ID (must match transfer's destination) "reason": "Amount doesn't match" # Optional }

POST /api/{installed_plugin_prefix}/cash-transfer/{external_id}/reject/ — action reject_transfer. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Observed authorization checks: can_list_facility_location_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Transfer ID is required; ValidationError (dynamic detail; inspect source); PermissionDenied (dynamic detail; inspect source); NotFound (dynamic detail; inspect source).

cancel_transfer · PUT

Cancel a pending cash transfer (by sender).

PUT /facility/{facility_external_id}/cash-transfer/{id}/cancel/ { "counter_x_care_id": "UUID", # The counter from which transfer was initiated "reason": "Transfer created by mistake" # Optional }

PUT /api/{installed_plugin_prefix}/cash-transfer/{external_id}/cancel/ — action cancel_transfer. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Observed authorization checks: can_list_facility_location_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Transfer ID is required; ValidationError (dynamic detail; inspect source); PermissionDenied (dynamic detail; inspect source); NotFound (dynamic detail; inspect source).

cancel_transfer · POST

Cancel a pending cash transfer (by sender).

PUT /facility/{facility_external_id}/cash-transfer/{id}/cancel/ { "counter_x_care_id": "UUID", # The counter from which transfer was initiated "reason": "Transfer created by mistake" # Optional }

POST /api/{installed_plugin_prefix}/cash-transfer/{external_id}/cancel/ — action cancel_transfer. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Observed authorization checks: can_list_facility_location_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: Transfer ID is required; ValidationError (dynamic detail; inspect source); PermissionDenied (dynamic detail; inspect source); NotFound (dynamic detail; inspect source).

pending_transfers · GET

Get pending incoming transfers at a location.

GET /facility/{facility_external_id}/cash-transfer/pending/?counter_x_care_id=UUID

Returns transfers pending at the specified counter. User must have access to the counter.

GET /api/{installed_plugin_prefix}/cash-transfer/pending/ — action pending_transfers. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Directly observed request reads (these do not constitute a complete accepted-payload or requiredness guarantee):

Observed authorization checks: can_list_facility_location_obj. Helper/queryset evidence is included; this is not proof of complete security review.

Explicit response statuses in observed code: status.HTTP_200_OK. Other branches/framework exception handling may differ.

Declared refusal/error evidence: ValidationError: counter_x_care_id query parameter is required; ValidationError (dynamic detail; inspect source); PermissionDenied (dynamic detail; inspect source); NotFound (dynamic detail; inspect source).

Integration review checklist

Confirm the installed route and full schema; review authentication, organization/facility scoping, all accepted fields, value-state and date/time semantics, idempotency, pagination, response/exception branches and the allowed correction/reversal workflow. Test positive and negative cases with synthetic data. This source reference does not establish external certification or replace an illustrated user procedure.