Backend resource · STATIC DECLARATIONS

Data Subject Request API reference · mansoq-core

Static source contract for Data Subject Request: 5 declared or inherited operation mappings, schema/field evidence and authorization/refusal references. Deployment and behavioral review remain explicit.

Static API contract — behavior review pending. Source baseline 3dfb7c9f519f.

Enable JavaScript to inspect structured operation, parameter, schema and permission evidence. Download this reference and its evidence.

Declared route and availability

This resource is declared in mansoq-core at /api/v1/facility/{facility_external_id}/data_subject_requests/. verified core mount in config/urls.py A registered path and an indexed handler do not prove deployment availability, user permission or production readiness.

Operation map

Method	Path	Action	Evidence
GET	`/api/v1/facility/{facility_external_id}/data_subject_requests/`	list	declared/inherited method
POST	`/api/v1/facility/{facility_external_id}/data_subject_requests/`	create	declared/inherited method
GET	`/api/v1/facility/{facility_external_id}/data_subject_requests/{external_id}/`	retrieve	declared/inherited method
POST	`/api/v1/facility/{facility_external_id}/data_subject_requests/{external_id}/decide/`	decide	@action declaration
GET	`/api/v1/facility/{facility_external_id}/data_subject_requests/{external_id}/access_bundle/`	access_bundle	@action declaration

list · GET

GET /api/v1/facility/{facility_external_id}/data_subject_requests/ — action list. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true

response: DataSubjectRequestReadSpec. Declared fields below; inherited fields are retained in the schema inventory.

Field	Type	Required	Constraints
meta	dict	false	No extra constraint extracted
id	UUID4	true	No extra constraint extracted
patient	dict	true	No extra constraint extracted
kind	DataSubjectKind	true	No extra constraint extracted
requester	dict	true	No extra constraint extracted
received_at	datetime	true	No extra constraint extracted
status	str	true	No extra constraint extracted
decision	str	true	No extra constraint extracted
decision_reason	str	true	No extra constraint extracted
decided_by	dict \| None	false	No extra constraint extracted
decided_at	datetime \| None	false	No extra constraint extracted
evidence	list	true	No extra constraint extracted
bundle_sha256	str	true	No extra constraint extracted
fulfilled_at	datetime \| None	false	No extra constraint extracted
fulfilled_by	dict \| None	false	No extra constraint extracted
rectification	dict \| None	false	No extra constraint extracted
created_date	datetime	true	No extra constraint extracted
modified_date	datetime	true	No extra constraint extracted

Authorization: no literal permission name was resolved in the bounded handler/helper traversal. Authentication, inherited policies, object/facility scoping and middleware still require review; this does not mean public access.

Declared refusal/error evidence: PermissionDenied (dynamic detail; inspect source).

create · POST

POST /api/v1/facility/{facility_external_id}/data_subject_requests/ — action create. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true

response: DataSubjectRequestReadSpec. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

body validation: DataSubjectRequestCreateSpec. Declared fields below; inherited fields are retained in the schema inventory.

Field	Type	Required	Constraints
patient	UUID4	true	No extra constraint extracted
kind	DataSubjectKind	true	No extra constraint extracted
requester	DataSubjectRequester	true	No extra constraint extracted
received_at	AwareDatetime	true	No extra constraint extracted
evidence	list[DataSubjectEvidence]	false	max_length: 20

decorator request: DataSubjectRequestCreateSpec. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

Explicit response statuses in observed code: response_status. Other branches/framework exception handling may differ.

Declared refusal/error evidence: _invalid: received_at_in_future; Http404: No Patient matches the given query.; PermissionDenied (dynamic detail; inspect source).

retrieve · GET

GET /api/v1/facility/{facility_external_id}/data_subject_requests/{external_id}/ — action retrieve. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

response: DataSubjectRequestReadSpec. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

Declared refusal/error evidence: PermissionDenied (dynamic detail; inspect source).

decide · POST

POST /api/v1/facility/{facility_external_id}/data_subject_requests/{external_id}/decide/ — action decide. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

body validation: DataSubjectRequestDecideSpec. Declared fields below; inherited fields are retained in the schema inventory.

Field	Type	Required	Constraints
decision	DataSubjectDecision	true	No extra constraint extracted
reason	str	false	max_length: 2000

decorator request: DataSubjectRequestDecideSpec. Declared fields below; inherited fields are retained in the schema inventory.

The declared field table is shown at its first occurrence in this reference; this operation links the same schema.

Explicit response statuses in observed code: response_status. Other branches/framework exception handling may differ.

Declared refusal/error evidence: _invalid: request_already_decided; PermissionDenied (dynamic detail; inspect source).

access_bundle · GET

GET /api/v1/facility/{facility_external_id}/data_subject_requests/{external_id}/access_bundle/ — action access_bundle. static contract extracted; runtime/permission/payload behavior review pending.

Path and deployment-context parameters:

Location	Parameter	Type	Required
path	facility_external_id	router lookup string; semantic ID validation requires handler/schema review	true
path	external_id	router lookup string; semantic ID validation requires handler/schema review	true

Declared refusal/error evidence: _invalid: not_an_access_request; _invalid: request_not_approved; PermissionDenied (dynamic detail; inspect source).

Integration review checklist

Confirm the installed route and full schema; review authentication, organization/facility scoping, all accepted fields, value-state and date/time semantics, idempotency, pagination, response/exception branches and the allowed correction/reversal workflow. Test positive and negative cases with synthetic data. This source reference does not establish external certification or replace an illustrated user procedure.

Pinned source evidence

Links require access to the private source repository.