API Categories

OpenAPI Explorer

Auto-generated OpenAPI definition for all enabled modules.

Default server: https://hr.office.dac.systems/api

Authentication & Accounts

Showing 20 of 36 endpoints

GET/auth/admin/nav

Auth required

Resolve backend chrome bootstrap payload

Returns the backend chrome payload available to the authenticated administrator after applying scope, RBAC, role defaults, and personal sidebar preferences.

Responses

200Backend chrome payload

Content-Type: application/json

{
  "brand": null,
  "groups": [
    {
      "name": "string",
      "items": [
        {
          "href": "string",
          "title": "string"
        }
      ]
    }
  ],
  "settingsSections": [
    {
      "id": "string",
      "label": "string",
      "items": [
        {
          "id": "string",
          "label": "string",
          "href": "string"
        }
      ]
    }
  ],
  "settingsPathPrefixes": [
    "string"
  ],
  "profileSections": [
    {
      "id": "string",
      "label": "string",
      "items": [
        {
          "id": "string",
          "label": "string",
          "href": "string"
        }
      ]
    }
  ],
  "profilePathPrefixes": [
    "string"
  ],
  "grantedFeatures": [
    "string"
  ],
  "roles": [
    "string"
  ],
  "currentOrganization": null
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/auth/admin/nav" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/auth/autologin

Auto sign-in using env-configured demo credentials

When OM_AUTOLOGIN_EMAIL / OM_AUTOLOGIN_PASSWORD are configured, signs the visitor in with those credentials and redirects into the app. Intended for single-tenant demo instances only. Falls back to the login page when disabled or misconfigured.

Responses

200Success response

Content-Type: application/json

"string"

307Redirect into the app (or to /login on failure)

Content-Type: text/html

string

Example

curl -X GET "https://hr.office.dac.systems/api/auth/autologin" \
  -H "Accept: application/json"

POST/auth/feature-check

Auth required

Check feature grants for the current user

Evaluates which of the requested features are available to the signed-in user within the active tenant / organization context.

Request body (application/json)

{
  "features": [
    "string"
  ]
}

Responses

200Evaluation result

Content-Type: application/json

{
  "ok": true,
  "granted": [
    "string"
  ],
  "userId": "string"
}

400Invalid request — features array missing, too large, or contains invalid entries

Content-Type: application/json

{
  "ok": false,
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "ok": false,
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/auth/feature-check" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"features\": [
    \"string\"
  ]
}"

GET/auth/features

Auth required

List declared feature flags

Returns all static features contributed by the enabled modules along with their module source.

Responses

200Aggregated feature catalog

Content-Type: application/json

{
  "items": [
    {
      "id": "string",
      "title": "string",
      "module": "string"
    }
  ],
  "modules": [
    {
      "id": "string",
      "title": "string"
    }
  ]
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/auth/features" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/auth/locale

Set locale and redirect

Stores the selected locale in a cookie and redirects to a safe local path.

Parameters

Name	In	Required	Schema	Description
locale	query	Yes	any	A locale code this tenant serves — one of the `servable` entries returned by `GET /api/translations/locales`. Codes are canonicalized (`de-AT` → `de`).
redirect	query	No	any	—

Responses

200Success response

Content-Type: application/json

"string"

302Locale cookie set and request redirected

Content-Type: application/json

"string"

400Invalid locale

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/auth/locale?locale=string" \
  -H "Accept: application/json"

POST/auth/locale

Set locale

Stores the selected locale in a cookie and returns a JSON success response.

Request body (application/json)

{
  "locale": "string"
}

Responses

200Locale cookie set

Content-Type: application/json

{
  "ok": true
}

400Invalid locale or malformed request body

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/auth/locale" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "{
  \"locale\": \"string\"
}"

POST/auth/login

Authenticate user credentials

Validates the submitted credentials and issues a bearer token cookie for subsequent API calls.

Request body (application/x-www-form-urlencoded)

email=user%40example.com&password=string

Responses

200Authentication succeeded

Content-Type: application/json

{
  "ok": true,
  "token": "string",
  "redirect": null
}

400Validation failed

Content-Type: application/json

{
  "ok": false,
  "error": "string"
}

401Invalid credentials

Content-Type: application/json

{
  "ok": false,
  "error": "string"
}

403User lacks required role

Content-Type: application/json

{
  "ok": false,
  "error": "string"
}

429Too many login attempts

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/auth/login" \
  -H "Accept: application/json" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "email=user%40example.com&password=string"

POST/auth/logout

Auth required

Invalidate session and redirect

Clears authentication cookies and redirects the browser to the login page.

Responses

201Success response

Content-Type: application/json

"string"

302Redirect to login after successful logout

Content-Type: text/html

string

Example

curl -X POST "https://hr.office.dac.systems/api/auth/logout" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/auth/profile

Auth required

Get current profile

Returns the email address, display name, and roles for the signed-in user. The display name is null when unset.

Responses

200Profile payload

Content-Type: application/json

{
  "email": "user@example.com",
  "name": null,
  "roles": [
    "string"
  ]
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404User not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/auth/profile" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/auth/profile

Auth required

Update current profile

Updates the email address or password for the signed-in user.

Request body (application/json)

{}

Responses

200Profile updated

Content-Type: application/json

{
  "ok": true,
  "email": "user@example.com"
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/auth/profile" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{}"

POST/auth/reset

Send reset email

Requests a password reset email for the given account. The endpoint always returns `ok: true` to avoid leaking account existence.

Request body (application/x-www-form-urlencoded)

email=user%40example.com

Responses

200Reset email dispatched (or ignored for unknown accounts)

Content-Type: application/json

{
  "ok": true
}

400Invalid request origin

Content-Type: application/json

{
  "error": "string"
}

429Too many password reset requests

Content-Type: application/json

{
  "error": "string"
}

500Password reset email origin is not configured

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/auth/reset" \
  -H "Accept: application/json" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "email=user%40example.com"

POST/auth/reset/confirm

Complete password reset

Validates the reset token and updates the user password. The returned `redirect` carries the resolved user's tenant as a navigation hint (`/login?tenant=...`) so a tenant-bound user lands on the tenant login entry; tenantless users get `/login`.

Request body (application/x-www-form-urlencoded)

token=string&password=string

Responses

200Password reset succeeded

Content-Type: application/json

{
  "ok": true,
  "redirect": "string"
}

400Invalid token or payload

Content-Type: application/json

{
  "ok": false,
  "error": "string"
}

429Too many reset confirmation attempts

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/auth/reset/confirm" \
  -H "Accept: application/json" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "token=string&password=string"

POST/auth/reset/validate

Check whether a password reset token is still usable

Reports whether a reset token exists, is unused, and has not expired, so the reset page can render a terminal state instead of a form the token can never submit. The token is never consumed and the response never distinguishes unknown, used, and expired tokens.

Request body (application/x-www-form-urlencoded)

token=string

Responses

200Token state resolved

Content-Type: application/json

{
  "ok": true,
  "valid": true
}

429Too many token validation attempts

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/auth/reset/validate" \
  -H "Accept: application/json" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "token=string"

GET/auth/roles

Auth required

List roles

Returns available roles within the current tenant. Super administrators receive visibility across tenants.

Parameters

Name	In	Required	Schema	Description
id	query	No	any	—
page	query	No	any	—
pageSize	query	No	any	—
search	query	No	any	—
tenantId	query	No	any	—

Responses

200Role collection

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "name": "string",
      "usersCount": 1,
      "tenantId": null,
      "tenantName": null,
      "updatedAt": null
    }
  ],
  "total": 1,
  "totalPages": 1
}

Example

curl -X GET "https://hr.office.dac.systems/api/auth/roles?page=1&pageSize=50" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/auth/roles

Auth required

Create role

Creates a new role anchored to the caller's tenant. Non-superadmins cannot target another tenant; supplying a foreign `tenantId` is rejected.

Request body (application/json)

{
  "name": "string"
}

Responses

201Role created

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000"
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/auth/roles" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"name\": \"string\"
}"

PUT/auth/roles

Auth required

Update role

Updates mutable fields on an existing role.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000"
}

Responses

200Role updated

Content-Type: application/json

{
  "ok": true
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Role not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/auth/roles" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\"
}"

DELETE/auth/roles

Auth required

Delete role

Deletes a role by identifier. Fails when users remain assigned.

Parameters

Name	In	Required	Schema	Description
id	query	Yes	any	Role identifier

Responses

200Role deleted

Content-Type: application/json

{
  "ok": true
}

400Role cannot be deleted

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Role not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/auth/roles?id=00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/auth/roles/acl

Auth required

Fetch role ACL

Returns the feature and organization assignments associated with a role within the current tenant.

Parameters

Name	In	Required	Schema	Description
roleId	query	Yes	any	—
tenantId	query	No	any	—

Responses

200Role ACL entry

Content-Type: application/json

{
  "isSuperAdmin": true,
  "features": [
    "string"
  ],
  "organizations": null,
  "updatedAt": null
}

400Invalid role id

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Role not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/auth/roles/acl?roleId=00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/auth/roles/acl

Auth required

Update role ACL

Replaces the feature list, super admin flag, and optional organization assignments for a role.

Request body (application/json)

{
  "roleId": "00000000-0000-4000-8000-000000000000",
  "organizations": null
}

Responses

200Role ACL updated

Content-Type: application/json

{
  "ok": true,
  "sanitized": true
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Insufficient privileges to modify ACL

Content-Type: application/json

{
  "error": "string"
}

404Role not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/auth/roles/acl" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"roleId\": \"00000000-0000-4000-8000-000000000000\",
  \"organizations\": null
}"

GET/auth/session/refresh

Refresh auth cookie from session token (browser)

Exchanges an existing `session_token` cookie for a fresh JWT auth cookie and redirects the browser.

Parameters

Name	In	Required	Schema	Description
redirect	query	No	any	Absolute or relative URL to redirect after refresh

Responses

200Success response

Content-Type: application/json

"string"

302Redirect to target location when session is valid

Content-Type: text/html

string

Example

curl -X GET "https://hr.office.dac.systems/api/auth/session/refresh" \
  -H "Accept: application/json"

Directory (Tenants & Organizations)

Showing 2 of 2 endpoints

GET/directory/organizations/lookup

Public organization lookup by slug

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/directory/organizations/lookup" \
  -H "Accept: application/json"

GET/directory/tenants/lookup

Public tenant lookup

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/directory/tenants/lookup" \
  -H "Accept: application/json"

API Documentation

Showing 1 of 1 endpoints

GET/version

Deployed Open Mercato version

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/version" \
  -H "Accept: application/json"

Audit & Action Logs

Showing 5 of 5 endpoints

GET/audit_logs/audit-logs/access

Auth required

Retrieve access logs

Fetches paginated access audit logs scoped to the authenticated user. Tenant administrators can optionally expand the search to other actors or organizations.

Parameters

Name	In	Required	Schema	Description
organizationId	query	No	any	Limit results to a specific organization
actorUserId	query	No	any	Filter by actor user id (tenant administrators only)
resourceKind	query	No	any	Restrict to a resource kind such as `order` or `product`
accessType	query	No	any	Access type filter, e.g. `read` or `export`
page	query	No	any	Page number (default 1)
pageSize	query	No	any	Page size (default 50)
limit	query	No	any	Explicit maximum number of records when paginating manually
before	query	No	any	Return logs created before this ISO-8601 timestamp
after	query	No	any	Return logs created after this ISO-8601 timestamp

Responses

200Access logs returned successfully

Content-Type: application/json

{
  "items": [
    {
      "id": "string",
      "resourceKind": "string",
      "resourceId": "string",
      "accessType": "string",
      "actorUserId": null,
      "actorUserName": null,
      "tenantId": null,
      "tenantName": null,
      "organizationId": null,
      "organizationName": null,
      "fields": [
        "string"
      ],
      "context": null,
      "createdAt": "string"
    }
  ],
  "canViewTenant": true,
  "page": 1,
  "pageSize": 1,
  "total": 1,
  "totalPages": 1
}

400Invalid filters supplied

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Caller has no resolved tenant scope and is not a superadmin

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/audit_logs/audit-logs/access" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/audit_logs/audit-logs/actions

Auth required

Fetch action logs

Returns recent action audit log entries. Tenant administrators can widen the scope to other actors or organizations, and callers can optionally restrict results to undoable actions.

Parameters

Name	In	Required	Schema	Description
organizationId	query	No	any	Limit results to a specific organization
actorUserId	query	No	any	Filter logs created by specific actor IDs (tenant administrators only). Accepts a single UUID or a comma-separated UUID list.
resourceKind	query	No	any	Filter by resource kind (e.g., "order", "product")
resourceId	query	No	any	Filter by resource ID (UUID of the specific record)
actionType	query	No	any	Filter by action type (`create`, `edit`, `delete`, `assign`). Accepts a single value or a comma-separated list.
fieldName	query	No	any	Filter to entries where the given field changed. Accepts a single field name or a comma-separated list.
includeRelated	query	No	any	When `true`, also returns changes to child entities linked via parentResourceKind/parentResourceId
includeTotal	query	No	any	When `true`, the response includes the filtered total count.
undoableOnly	query	No	any	When `true`, only undoable actions are returned
limit	query	No	any	Maximum number of records to return (default 50, max 1000)
offset	query	No	any	Zero-based record offset for pagination (legacy — prefer page/pageSize)
page	query	No	any	Page number (default 1)
pageSize	query	No	any	Page size (default 50, max 200)
sortField	query	No	any	Sort field: `createdAt`, `user`, `action`, `field`, or `source`.
sortDir	query	No	any	Sort direction: `asc` or `desc`.
before	query	No	any	Return actions created before this ISO-8601 timestamp
after	query	No	any	Return actions created after this ISO-8601 timestamp

Responses

200Action logs retrieved successfully

Content-Type: application/json

{
  "items": [
    {
      "id": "string",
      "commandId": "string",
      "actionLabel": null,
      "executionState": "done",
      "actorUserId": null,
      "actorUserName": null,
      "tenantId": null,
      "tenantName": null,
      "organizationId": null,
      "organizationName": null,
      "resourceKind": null,
      "resourceId": null,
      "parentResourceKind": null,
      "parentResourceId": null,
      "undoToken": null,
      "createdAt": "string",
      "updatedAt": "string",
      "snapshotBefore": null,
      "snapshotAfter": null,
      "changes": null,
      "context": null
    }
  ],
  "canViewTenant": true,
  "page": 1,
  "pageSize": 1,
  "total": 1,
  "totalPages": 1
}

400Invalid filter values

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Caller has no resolved tenant scope and is not a superadmin

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/audit_logs/audit-logs/actions?includeRelated=false&includeTotal=false&undoableOnly=false" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/audit_logs/audit-logs/actions/export

Auth required

Export action logs as CSV

Returns a CSV attachment containing filtered action audit log entries. Tenant administrators can widen the scope to other actors or organizations.

Parameters

Name	In	Required	Schema	Description
organizationId	query	No	any	Limit results to a specific organization
actorUserId	query	No	any	Filter logs created by specific actor IDs (tenant administrators only). Accepts a single UUID or a comma-separated UUID list.
resourceKind	query	No	any	Filter by resource kind (e.g., "order", "product")
resourceId	query	No	any	Filter by resource ID (UUID of the specific record)
actionType	query	No	any	Filter by action type (`create`, `edit`, `delete`, `assign`). Accepts a single value or a comma-separated list.
fieldName	query	No	any	Filter to entries where the given field changed. Accepts a single field name or a comma-separated list.
includeRelated	query	No	any	When `true`, also returns changes to child entities linked via parentResourceKind/parentResourceId
undoableOnly	query	No	any	When `true`, only undoable actions are returned
limit	query	No	any	Maximum number of records to export (default 1000, capped at 1000)
sortField	query	No	any	Sort field: `createdAt`, `user`, `action`, `field`, or `source`.
sortDir	query	No	any	Sort direction: `asc` or `desc`.
before	query	No	any	Return actions created before this ISO-8601 timestamp
after	query	No	any	Return actions created after this ISO-8601 timestamp

Responses

200CSV export generated successfully

Content-Type: application/json

{
  "file": "csv"
}

400Invalid filter values

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Caller has no resolved tenant scope and is not a superadmin

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/audit_logs/audit-logs/actions/export?includeRelated=false&undoableOnly=false" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/audit_logs/audit-logs/actions/redo

Auth required

Redo by action log id

Redoes the latest undone command owned by the caller. Requires the action to still be eligible for redo within tenant and organization scope.

Request body (application/json)

{
  "logId": "string"
}

Responses

200Redo executed successfully

Content-Type: application/json

{
  "ok": true,
  "logId": null,
  "undoToken": null
}

400Log not eligible for redo

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Redo blocked by scope checks

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/audit_logs/audit-logs/actions/redo" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"logId\": \"string\"
}"

POST/audit_logs/audit-logs/actions/undo

Auth required

Undo action by token

Replays the undo handler registered for a command. The provided undo token must match the latest undoable log entry accessible to the caller.

Request body (application/json)

{
  "undoToken": "string"
}

Responses

200Undo applied successfully

Content-Type: application/json

{
  "ok": true,
  "logId": "string"
}

400Invalid or unavailable undo token

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Undo blocked by organization or tenant scope

Content-Type: application/json

{
  "error": "string"
}

422Undo deliberately blocked by a beforeUndo command interceptor. The interceptor chooses the status (any 4xx/5xx) and may replace the body.

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/audit_logs/audit-logs/actions/undo" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"undoToken\": \"string\"
}"

Notifications

Showing 20 of 22 endpoints

GET/notifications

Auth required

List notifications

Returns a paginated collection of notifications.

Parameters

Name	In	Required	Schema	Description
status	query	No	any	—
type	query	No	any	—
severity	query	No	any	—
sourceEntityType	query	No	any	—
sourceEntityId	query	No	any	—
since	query	No	any	—
page	query	No	any	—
pageSize	query	No	any	—
ids	query	No	any	Comma-separated list of record UUIDs to filter by (max 200).

Responses

200Paginated notifications

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "type": "string",
      "title": "string",
      "body": null,
      "titleKey": null,
      "bodyKey": null,
      "titleVariables": null,
      "bodyVariables": null,
      "icon": null,
      "severity": "string",
      "status": "string",
      "actions": [
        {
          "id": "string",
          "label": "string"
        }
      ],
      "sourceModule": null,
      "sourceEntityType": null,
      "sourceEntityId": null,
      "linkHref": null,
      "createdAt": "string",
      "readAt": null,
      "actionTaken": null
    }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1,
  "totalPages": 1
}

403Request could not be resolved to a tenant scope (code: tenant_scope_required)

Content-Type: application/json

{
  "error": "string",
  "code": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/notifications?page=1&pageSize=20" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/notifications

Auth required

Create notification

Creates a notification for a user.

Request body (application/json)

{
  "type": "string",
  "severity": "info",
  "recipientUserId": "00000000-0000-4000-8000-000000000000"
}

Responses

201Notification created

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000"
}

Example

curl -X POST "https://hr.office.dac.systems/api/notifications" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"type\": \"string\",
  \"severity\": \"info\",
  \"recipientUserId\": \"00000000-0000-4000-8000-000000000000\"
}"

POST/notifications/{id}/action

Auth required

POST /notifications/{id}/action

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

201Success response

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/notifications/:id/action" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/notifications/{id}/dismiss

Auth required

PUT /notifications/{id}/dismiss

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/notifications/:id/dismiss" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/notifications/{id}/read

Auth required

PUT /notifications/{id}/read

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/notifications/:id/read" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/notifications/{id}/restore

Auth required

PUT /notifications/{id}/restore

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/notifications/:id/restore" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/notifications/admin/preferences

Auth required

GET /notifications/admin/preferences

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/notifications/admin/preferences" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/notifications/admin/preferences

Auth required

PUT /notifications/admin/preferences

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/notifications/admin/preferences" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/notifications/batch

Auth required

POST /notifications/batch

Responses

201Success response

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/notifications/batch" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/notifications/channels

Auth required

GET /notifications/channels

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/notifications/channels" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/notifications/feature

Auth required

POST /notifications/feature

Responses

201Success response

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/notifications/feature" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/notifications/mark-all-read

Auth required

PUT /notifications/mark-all-read

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/notifications/mark-all-read" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/notifications/preferences

Auth required

GET /notifications/preferences

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/notifications/preferences" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/notifications/preferences

Auth required

PUT /notifications/preferences

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/notifications/preferences" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/notifications/role

Auth required

POST /notifications/role

Responses

201Success response

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/notifications/role" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/notifications/settings

Auth required

GET /notifications/settings

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/notifications/settings" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/notifications/settings

Auth required

POST /notifications/settings

Responses

201Success response

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/notifications/settings" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/notifications/types

Auth required

GET /notifications/types

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/notifications/types" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PATCH/notifications/types

Auth required

PATCH /notifications/types

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PATCH "https://hr.office.dac.systems/api/notifications/types" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/notifications/types/{id}/channels/{channel}

Auth required

PUT /notifications/types/{id}/channels/{channel}

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—
channel	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/notifications/types/:id/channels/:channel" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Events

Showing 2 of 2 endpoints

GET/events

Auth required

List declared events

Returns every declared event, including its declared payloadSchema when the module (or the generated CRUD default) provides one. Filters: category, module, excludeTriggerExcluded (default true).

Responses

200Declared events

Content-Type: application/json

{
  "data": [
    {
      "id": "string",
      "label": "string"
    }
  ],
  "total": 1
}

Example

curl -X GET "https://hr.office.dac.systems/api/events" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/events/stream

Auth required

GET /events/stream

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/events/stream" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Search

Showing 15 of 15 endpoints

GET/search/embeddings

Auth required

Get embeddings configuration

Returns current embedding provider and model configuration.

Responses

200Embeddings settings

Content-Type: application/json

{
  "settings": {
    "openaiConfigured": true,
    "autoIndexingEnabled": true,
    "autoIndexingLocked": true,
    "lockReason": null,
    "embeddingConfig": null,
    "configuredProviders": [
      "openai"
    ],
    "indexedDimension": null,
    "reindexRequired": true,
    "documentCount": null
  }
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/search/embeddings" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/search/embeddings

Auth required

Update embeddings configuration

Updates the embedding provider and model settings.

Request body (application/json)

{}

Responses

200Updated settings

Content-Type: application/json

{
  "settings": {
    "openaiConfigured": true,
    "autoIndexingEnabled": true,
    "autoIndexingLocked": true,
    "lockReason": null,
    "embeddingConfig": null,
    "configuredProviders": [
      "openai"
    ],
    "indexedDimension": null,
    "reindexRequired": true,
    "documentCount": null
  }
}

400Invalid request

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

409Auto-indexing disabled via environment

Content-Type: application/json

{
  "error": "string"
}

500Update failed

Content-Type: application/json

{
  "error": "string"
}

503Configuration service unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/search/embeddings" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{}"

POST/search/embeddings/reindex

Auth required

Trigger vector reindex

Starts a vector embedding reindex operation.

Request body (application/json)

{}

Responses

200Reindex result

Content-Type: application/json

{
  "ok": true
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

409Reindex already in progress

Content-Type: application/json

{
  "error": "string",
  "lock": {
    "type": "fulltext",
    "action": "string",
    "startedAt": "string",
    "elapsedMinutes": 1,
    "processedCount": null,
    "totalCount": null
  }
}

500Reindex failed

Content-Type: application/json

{
  "error": "string"
}

503Search indexer unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/search/embeddings/reindex" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{}"

POST/search/embeddings/reindex/cancel

Auth required

Cancel vector reindex

Cancels an in-progress vector reindex operation.

Responses

200Cancel result

Content-Type: application/json

{
  "ok": true,
  "jobsRemoved": 1
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/search/embeddings/reindex/cancel" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/search/index

Auth required

List vector index entries

Returns paginated list of entries in the vector search index.

Parameters

Name	In	Required	Schema	Description
entityId	query	No	any	Filter by entity ID (e.g., "customers:customer_person_profile", "catalog:catalog_product")
limit	query	No	any	Maximum entries to return (default: 50, max: 200)
offset	query	No	any	Offset for pagination (default: 0)

Responses

200Index entries

Content-Type: application/json

{
  "entries": [
    {
      "id": "string",
      "entityId": "string",
      "recordId": "string",
      "tenantId": "string",
      "organizationId": null
    }
  ],
  "limit": 1,
  "offset": 1
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

500Failed to fetch index

Content-Type: application/json

{
  "error": "string"
}

503Vector strategy unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/search/index" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

DELETE/search/index

Auth required

Purge vector index

Purges entries from the vector search index. Requires confirmAll=true when purging all entities.

Parameters

Name	In	Required	Schema	Description
entityId	query	No	any	Specific entity ID to purge (e.g., "customers:customer_person_profile", "catalog:catalog_product")
confirmAll	query	No	any	Required when purging all entities

Responses

200Purge result

Content-Type: application/json

{
  "ok": true
}

400Missing confirmAll parameter

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

500Purge failed

Content-Type: application/json

{
  "error": "string"
}

503Search indexer unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/search/index" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/search/reindex

Auth required

Trigger fulltext reindex

Starts a fulltext (Meilisearch) reindex operation. Can clear, recreate, or fully reindex.

Request body (application/json)

{}

Responses

200Reindex result

Content-Type: application/json

{
  "ok": true,
  "action": "clear",
  "entityId": null
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

409Reindex already in progress

Content-Type: application/json

{
  "error": "string",
  "lock": {
    "type": "fulltext",
    "action": "string",
    "startedAt": "string",
    "elapsedMinutes": 1,
    "processedCount": null,
    "totalCount": null
  }
}

500Reindex failed

Content-Type: application/json

{
  "error": "string"
}

503Search service unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/search/reindex" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{}"

POST/search/reindex/cancel

Auth required

Cancel fulltext reindex

Cancels an in-progress fulltext reindex operation.

Responses

200Cancel result

Content-Type: application/json

{
  "ok": true,
  "jobsRemoved": 1
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/search/reindex/cancel" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/search/search

Auth required

Search across all indexed entities

Performs a search using configured strategies (fulltext, vector, tokens). Use for search playground. Results are limited to the entity types the caller holds the declared view features for; superadmins are exempt.

Parameters

Name	In	Required	Schema	Description
q	query	Yes	any	Search query (required)
limit	query	No	any	Maximum results to return (default: 50, max: 100)
strategies	query	No	any	Comma-separated strategies to use: fulltext, vector, tokens (e.g., "fulltext,vector")
entityTypes	query	No	any	Comma-separated entity types to filter results (e.g., "customers:customer_person_profile,catalog:catalog_product,sales:sales_order")

Responses

200Search results

Content-Type: application/json

{
  "results": [
    {
      "entityId": "string",
      "recordId": "string",
      "score": 1,
      "source": "fulltext"
    }
  ],
  "strategiesUsed": [
    "fulltext"
  ],
  "timing": 1,
  "query": "string",
  "limit": 1
}

400Missing query parameter

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

500Search failed

Content-Type: application/json

{
  "error": "string"
}

503Search service unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/search/search?q=string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/search/search/global

Auth required

Global search (Cmd+K)

Performs a global search using saved tenant strategies. Does NOT accept strategies from URL.

Parameters

Name	In	Required	Schema	Description
q	query	Yes	any	Search query (required)
limit	query	No	any	Maximum results to return (default: 50, max: 100)
entityTypes	query	No	any	Comma-separated entity types to filter results (e.g., "customers:customer_person_profile,catalog:catalog_product,sales:sales_order")

Responses

200Search results

Content-Type: application/json

{
  "results": [
    {
      "entityId": "string",
      "recordId": "string",
      "score": 1,
      "source": "fulltext"
    }
  ],
  "strategiesUsed": [
    "fulltext"
  ],
  "strategiesEnabled": [
    "fulltext"
  ],
  "timing": 1,
  "query": "string",
  "limit": 1
}

400Missing query parameter

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

500Search failed

Content-Type: application/json

{
  "error": "string"
}

503Search service unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/search/search/global?q=string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/search/settings

Auth required

Get search settings and status

Returns search module configuration, available strategies, and reindex lock status.

Responses

200Search settings

Content-Type: application/json

{
  "settings": {
    "strategies": [
      {
        "id": "string",
        "name": "string",
        "priority": 1,
        "available": true
      }
    ],
    "fulltextConfigured": true,
    "fulltextStats": null,
    "vectorConfigured": true,
    "tokensEnabled": true,
    "defaultStrategies": [
      "string"
    ],
    "reindexLock": null,
    "fulltextReindexLock": null,
    "vectorReindexLock": null
  }
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/search/settings" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/search/settings/fulltext

Auth required

Get fulltext search configuration

Returns Meilisearch configuration status and index statistics.

Responses

200Fulltext settings

Content-Type: application/json

{
  "driver": null,
  "configured": true,
  "envVars": {
    "MEILISEARCH_HOST": {
      "set": true,
      "hint": "string"
    },
    "MEILISEARCH_API_KEY": {
      "set": true,
      "hint": "string"
    }
  },
  "optionalEnvVars": {
    "MEILISEARCH_INDEX_PREFIX": {
      "set": true,
      "hint": "string"
    },
    "SEARCH_EXCLUDE_ENCRYPTED_FIELDS": {
      "set": true,
      "hint": "string"
    }
  }
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/search/settings/fulltext" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/search/settings/global-search

Auth required

Get global search strategies

Returns the enabled strategies for Cmd+K global search.

Responses

200Global search settings

Content-Type: application/json

{
  "enabledStrategies": [
    "fulltext"
  ]
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/search/settings/global-search" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/search/settings/global-search

Auth required

Update global search strategies

Sets which strategies are enabled for Cmd+K global search.

Request body (application/json)

{
  "enabledStrategies": [
    "fulltext"
  ]
}

Responses

200Updated settings

Content-Type: application/json

{
  "ok": true,
  "enabledStrategies": [
    "fulltext"
  ]
}

400Invalid request

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

500Internal error

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/search/settings/global-search" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"enabledStrategies\": [
    \"fulltext\"
  ]
}"

GET/search/settings/vector-store

Auth required

Get vector store configuration

Returns vector store configuration status.

Responses

200Vector store settings

Content-Type: application/json

{
  "currentDriver": "pgvector",
  "configured": true,
  "drivers": [
    {
      "id": "pgvector",
      "name": "string",
      "configured": true,
      "implemented": true,
      "available": null,
      "unavailableReason": null,
      "envVars": [
        {
          "name": "string",
          "set": true,
          "hint": "string"
        }
      ]
    }
  ]
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/search/settings/vector-store" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Attachments

Showing 14 of 14 endpoints

GET/attachments

Auth required

List attachments for a record

Returns uploaded attachments for the given entity record, ordered by newest first.

Parameters

Name	In	Required	Schema	Description
entityId	query	Yes	any	Entity identifier that owns the attachments
recordId	query	Yes	any	Record identifier within the entity
page	query	No	any	—
pageSize	query	No	any	—

Responses

200Attachments found for the record

Content-Type: application/json

{
  "items": [
    {
      "id": "string",
      "url": "string",
      "fileName": "string",
      "fileSize": 1,
      "createdAt": "string",
      "mimeType": null,
      "content": null
    }
  ]
}

400Missing entity or record identifiers

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/attachments?entityId=string&recordId=string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/attachments

Auth required

Upload attachment

Uploads a new attachment using multipart form-data and stores metadata for later retrieval.

Request body (multipart/form-data)

entityId=string
recordId=string
file=string

Responses

200Attachment stored successfully

Content-Type: application/json

{
  "ok": true,
  "item": {
    "id": "string",
    "url": "string",
    "fileName": "string",
    "fileSize": 1,
    "content": null
  }
}

400Payload validation error

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Attachment violates field constraints

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/attachments" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: multipart/form-data" \
  -d "{
  \"entityId\": \"string\",
  \"recordId\": \"string\",
  \"file\": \"string\"
}"

DELETE/attachments

Auth required

Delete attachment

Removes an uploaded attachment and deletes the stored asset.

Parameters

Name	In	Required	Schema	Description
id	query	Yes	any	—

Responses

200Attachment deleted

Content-Type: application/json

{
  "ok": true
}

400Missing attachment identifier

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Attachment not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/attachments?id=00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/attachments/file/{id}

Download or serve attachment file

Returns the raw file content for an attachment. Path parameter: {id} - Attachment UUID. Query parameter: ?download=1 - Force file download with Content-Disposition header. Access control is enforced based on partition settings.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200File content with appropriate MIME type

Content-Type: application/json

"string"

400Missing attachment ID

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized - authentication required for private partitions

Content-Type: application/json

{
  "error": "string"
}

403Forbidden - insufficient permissions

Content-Type: application/json

{
  "error": "string"
}

404Attachment or file not found

Content-Type: application/json

{
  "error": "string"
}

500Partition misconfigured

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/attachments/file/:id" \
  -H "Accept: application/json"

GET/attachments/image/{id}/{slug}

Serve image with optional resizing

Returns an image attachment with optional on-the-fly resizing and cropping. Resized images are cached for performance. Only works with image MIME types. Path parameter: {id} - Attachment UUID. Query parameters: ?width=N (1-4000 pixels), ?height=N (1-4000 pixels), ?cropType=cover|contain (resize behavior).

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—
slug	path	No	any	—

Responses

200Binary image content (Content-Type: image/jpeg, image/png, etc.)

Content-Type: application/json

"string"

400Invalid parameters, missing ID, or non-image attachment

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized - authentication required for private partitions

Content-Type: application/json

{
  "error": "string"
}

403Forbidden - insufficient permissions

Content-Type: application/json

{
  "error": "string"
}

404Image not found

Content-Type: application/json

{
  "error": "string"
}

500Partition misconfigured or image rendering failed

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/attachments/image/:id/:slug" \
  -H "Accept: application/json"

GET/attachments/library

Auth required

List attachments

Returns paginated list of attachments with optional filtering by search term, partition, and tags. Includes available tags and partitions.

Parameters

Name	In	Required	Schema	Description
page	query	No	any	Page number for pagination
pageSize	query	No	any	Number of items per page (max 100)
search	query	No	any	Search by file name (case-insensitive)
partition	query	No	any	Filter by partition code
tags	query	No	any	Filter by tags (comma-separated)
sortField	query	No	any	Field to sort by
sortDir	query	No	any	Sort direction

Responses

200Attachments list with pagination and metadata

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "fileName": "string",
      "fileSize": 1,
      "mimeType": "string",
      "partitionCode": "string",
      "partitionTitle": null,
      "url": null,
      "createdAt": "string",
      "tags": [
        "string"
      ],
      "assignments": [],
      "content": null
    }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1,
  "totalPages": 1,
  "availableTags": [
    "string"
  ],
  "partitions": [
    {
      "code": "string",
      "title": "string",
      "description": null,
      "isPublic": true
    }
  ]
}

400Invalid query parameters

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/attachments/library?page=1&pageSize=25" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/attachments/library/{id}

Auth required

Get attachment details

Returns complete details of an attachment including metadata, tags, assignments, and custom fields.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Attachment details

Content-Type: application/json

{
  "item": {
    "id": "00000000-0000-4000-8000-000000000000",
    "fileName": "string",
    "fileSize": 1,
    "mimeType": "string",
    "partitionCode": "string",
    "partitionTitle": null,
    "tags": [
      "string"
    ],
    "assignments": [],
    "content": null,
    "customFields": null
  }
}

400Invalid attachment ID

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Attachment not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/attachments/library/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PATCH/attachments/library/{id}

Auth required

Update attachment metadata

Updates attachment tags, assignments, and custom fields. Emits CRUD side effects for indexing and events.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{}

Responses

200Attachment updated successfully

Content-Type: application/json

{
  "ok": true
}

400Invalid payload or attachment ID

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Attachment not found

Content-Type: application/json

{
  "error": "string"
}

500Failed to save attributes

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PATCH "https://hr.office.dac.systems/api/attachments/library/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{}"

DELETE/attachments/library/{id}

Auth required

Delete attachment

Permanently deletes an attachment file from storage and database. Emits CRUD side effects.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Attachment deleted successfully

Content-Type: application/json

{
  "ok": true
}

400Invalid attachment ID

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Attachment not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/attachments/library/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/attachments/partitions

Auth required

List all attachment partitions

Returns all configured attachment partitions with storage settings, OCR configuration, and access control settings.

Responses

200List of partitions

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "code": "string",
      "title": "string",
      "description": null,
      "isPublic": true,
      "requiresOcr": true,
      "ocrModel": null,
      "configJson": null,
      "createdAt": null,
      "updatedAt": null,
      "envKey": "string"
    }
  ]
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/attachments/partitions" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/attachments/partitions

Auth required

Create new partition

Creates a new attachment partition with specified storage and OCR settings. Requires unique partition code.

Request body (application/json)

{
  "code": "string",
  "title": "string",
  "description": null,
  "ocrModel": null,
  "storageDriver": "local",
  "configJson": null
}

Responses

201Partition created successfully

Content-Type: application/json

{
  "item": {
    "id": "00000000-0000-4000-8000-000000000000",
    "code": "string",
    "title": "string",
    "description": null,
    "isPublic": true,
    "requiresOcr": true,
    "ocrModel": null,
    "configJson": null,
    "createdAt": null,
    "updatedAt": null,
    "envKey": "string"
  }
}

400Invalid payload or partition code

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Partitions locked in demo mode

Content-Type: application/json

{
  "error": "string"
}

409Partition code already exists

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/attachments/partitions" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"code\": \"string\",
  \"title\": \"string\",
  \"description\": null,
  \"ocrModel\": null,
  \"storageDriver\": \"local\",
  \"configJson\": null
}"

PUT/attachments/partitions

Auth required

Update partition

Updates an existing partition. Partition code cannot be changed. Title, description, OCR settings, and access control can be modified.

Request body (application/json)

{
  "code": "string",
  "title": "string",
  "description": null,
  "ocrModel": null,
  "storageDriver": "local",
  "configJson": null,
  "id": "00000000-0000-4000-8000-000000000000"
}

Responses

200Partition updated successfully

Content-Type: application/json

{
  "item": {
    "id": "00000000-0000-4000-8000-000000000000",
    "code": "string",
    "title": "string",
    "description": null,
    "isPublic": true,
    "requiresOcr": true,
    "ocrModel": null,
    "configJson": null,
    "createdAt": null,
    "updatedAt": null,
    "envKey": "string"
  }
}

400Invalid payload or code change attempt

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Partitions locked in demo mode

Content-Type: application/json

{
  "error": "string"
}

404Partition not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/attachments/partitions" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"code\": \"string\",
  \"title\": \"string\",
  \"description\": null,
  \"ocrModel\": null,
  \"storageDriver\": \"local\",
  \"configJson\": null,
  \"id\": \"00000000-0000-4000-8000-000000000000\"
}"

DELETE/attachments/partitions

Auth required

Delete partition

Deletes a partition. Default partitions cannot be deleted. Partitions with existing attachments cannot be deleted.

Responses

200Partition deleted successfully

Content-Type: application/json

{
  "ok": true
}

400Invalid ID or default partition deletion attempt

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Partitions locked in demo mode

Content-Type: application/json

{
  "error": "string"
}

404Partition not found

Content-Type: application/json

{
  "error": "string"
}

409Partition in use

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/attachments/partitions" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/attachments/transfer

Auth required

Transfer attachments to different record

Transfers one or more attachments from one record to another within the same entity type. Updates attachment assignments and metadata to reflect the new record.

Request body (application/json)

{
  "entityId": "string",
  "attachmentIds": [
    "00000000-0000-4000-8000-000000000000"
  ],
  "toRecordId": "string"
}

Responses

200Attachments transferred successfully

Content-Type: application/json

{
  "ok": true,
  "updated": 1
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Attachments not found

Content-Type: application/json

{
  "error": "string"
}

500Attachment model missing

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/attachments/transfer" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityId\": \"string\",
  \"attachmentIds\": [
    \"00000000-0000-4000-8000-000000000000\"
  ],
  \"toRecordId\": \"string\"
}"

API Keys

Showing 3 of 3 endpoints

GET/api_keys/keys

Auth required

List API keys

Returns paginated API keys visible to the current user, including per-key role assignments and organization context.

Parameters

Name	In	Required	Schema	Description
page	query	No	any	—
pageSize	query	No	any	—
search	query	No	any	—

Responses

200Collection of API keys

Content-Type: application/json

{
  "items": [
    {
      "id": "string",
      "name": "string",
      "description": null,
      "keyPrefix": "string",
      "organizationId": null,
      "organizationName": null,
      "createdAt": "string",
      "lastUsedAt": null,
      "expiresAt": null,
      "roles": [
        {
          "id": "string",
          "name": null
        }
      ]
    }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1,
  "totalPages": 1
}

400Tenant context missing

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Forbidden by organization scope

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/api_keys/keys" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/api_keys/keys

Auth required

Create API key

Creates a new API key, returning the one-time secret value together with the generated key prefix and scope details.

Request body (application/json)

{
  "name": "string",
  "description": null,
  "tenantId": null,
  "organizationId": null,
  "roles": [],
  "expiresAt": null
}

Responses

201API key created successfully

Content-Type: application/json

{
  "id": "string",
  "name": "string",
  "keyPrefix": "string",
  "tenantId": null,
  "organizationId": null,
  "roles": [
    {
      "id": "string",
      "name": null
    }
  ]
}

400Invalid payload or missing tenant context

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Organization outside allowed scope

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/api_keys/keys" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"name\": \"string\",
  \"description\": null,
  \"tenantId\": null,
  \"organizationId\": null,
  \"roles\": [],
  \"expiresAt\": null
}"

DELETE/api_keys/keys

Auth required

Delete API key

Removes an API key by identifier. The key must belong to the current tenant and fall within the requester organization scope.

Parameters

Name	In	Required	Schema	Description
id	query	Yes	any	API key identifier to delete

Responses

200Key deleted successfully

Content-Type: application/json

{
  "success": true
}

400Missing or invalid identifier

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Organization outside allowed scope

Content-Type: application/json

{
  "error": "string"
}

404Key not found within scope

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/api_keys/keys?id=00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Forms

Showing 18 of 18 endpoints

GET/forms

Auth required

List forms

Returns paginated forms scoped to the authenticated organization.

Parameters

Name	In	Required	Schema	Description
status	query	No	any	—
q	query	No	any	—
page	query	No	any	—
pageSize	query	No	any	—

Responses

200Form list

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "key": "string",
      "name": "string",
      "description": null,
      "status": "draft",
      "defaultLocale": "string",
      "supportedLocales": [
        "string"
      ],
      "currentPublishedVersionId": null,
      "currentPublishedVersionNumber": null,
      "draftVersionId": null,
      "createdAt": "string",
      "updatedAt": "string"
    }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1,
  "totalPages": 1
}

400Tenant or organization context missing

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/forms

Auth required

Create form

Creates a new form. Status starts as draft until a version is published.

Request body (application/json)

{
  "key": "string",
  "name": "string",
  "description": null,
  "defaultLocale": "string",
  "supportedLocales": [
    "string"
  ],
  "retentionDays": null
}

Responses

201Form created

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000"
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

422Form key already taken

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"key\": \"string\",
  \"name\": \"string\",
  \"description\": null,
  \"defaultLocale\": \"string\",
  \"supportedLocales\": [
    \"string\"
  ],
  \"retentionDays\": null
}"

GET/forms/{id}

Auth required

Get form detail

Returns the form metadata + version summaries.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Form detail

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "key": "string",
  "name": "string",
  "description": null,
  "status": "draft",
  "defaultLocale": "string",
  "supportedLocales": [
    "string"
  ],
  "currentPublishedVersionId": null,
  "createdAt": "string",
  "updatedAt": "string",
  "versions": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "versionNumber": 1,
      "status": "draft",
      "schemaHash": "string",
      "registryVersion": "string",
      "publishedAt": null,
      "publishedBy": null,
      "changelog": null,
      "archivedAt": null,
      "createdAt": "string",
      "updatedAt": "string"
    }
  ]
}

404Form not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PATCH/forms/{id}

Auth required

Update form metadata

Updates the form name, description, and/or locale set (supportedLocales + defaultLocale).

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "description": null,
  "retentionDays": null
}

Responses

200Form updated

Content-Type: application/json

{
  "ok": true,
  "updatedAt": "string"
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

404Form not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PATCH "https://hr.office.dac.systems/api/forms/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"description\": null,
  \"retentionDays\": null
}"

DELETE/forms/{id}

Auth required

Archive form

Soft-archives the form (sets archived_at, status=archived).

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Form archived

Content-Type: application/json

{
  "ok": true,
  "updatedAt": "string"
}

404Form not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/forms/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/forms/{id}/distributions

Auth required

List distributions

Returns all distributions for a form scoped to the authenticated organization.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Distribution list

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "formId": "00000000-0000-4000-8000-000000000000",
      "mode": "open",
      "status": "active",
      "publicSlug": null,
      "title": null,
      "defaultLocale": "string",
      "pinnedVersionId": null,
      "requireCustomerAuth": true,
      "allowMultipleSubmissions": true,
      "maxResponses": null,
      "responseCount": 1,
      "opensAt": null,
      "closesAt": null,
      "redirectUrl": null,
      "createdAt": "string",
      "updatedAt": "string"
    }
  ],
  "total": 1
}

400Organization context missing

Content-Type: application/json

{
  "error": "string"
}

404Form not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/00000000-0000-4000-8000-000000000000/distributions" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/forms/{id}/distributions

Auth required

Create distribution

Creates an open (public link) or personal (per-recipient invitations) distribution. Open distributions mint a public_slug.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "mode": "open",
  "pinnedVersionId": null,
  "title": null,
  "defaultLocale": "string",
  "maxResponses": null,
  "opensAt": null,
  "closesAt": null,
  "redirectUrl": null,
  "settings": null
}

Responses

201Distribution created

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000"
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

404Form not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/00000000-0000-4000-8000-000000000000/distributions" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"mode\": \"open\",
  \"pinnedVersionId\": null,
  \"title\": null,
  \"defaultLocale\": \"string\",
  \"maxResponses\": null,
  \"opensAt\": null,
  \"closesAt\": null,
  \"redirectUrl\": null,
  \"settings\": null
}"

GET/forms/{id}/versions/{versionId}

Auth required

Get version detail

Returns the full schema/uiSchema/roles for a form version.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—
versionId	path	Yes	any	—

Responses

200Form version detail

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "formId": "00000000-0000-4000-8000-000000000000",
  "versionNumber": 1,
  "status": "draft",
  "schema": {},
  "uiSchema": {},
  "roles": [
    "string"
  ],
  "schemaHash": "string",
  "registryVersion": "string",
  "publishedAt": null,
  "publishedBy": null,
  "changelog": null,
  "archivedAt": null,
  "createdAt": "string",
  "updatedAt": "string",
  "answerMappings": {
    "key": "string"
  }
}

404Version not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/00000000-0000-4000-8000-000000000000/versions/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PATCH/forms/{id}/versions/{versionId}

Auth required

Update draft version

Updates schema/uiSchema/roles/changelog on a draft version. Rejects with 409 (version_is_frozen) for non-draft versions.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—
versionId	path	Yes	any	—

Request body (application/json)

{
  "changelog": null
}

Responses

200Draft updated

Content-Type: application/json

{
  "ok": true,
  "updatedAt": "string"
}

404Version not found

Content-Type: application/json

{
  "error": "string"
}

409Version is frozen

Content-Type: application/json

{
  "error": "string"
}

422Schema validation failed

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PATCH "https://hr.office.dac.systems/api/forms/00000000-0000-4000-8000-000000000000/versions/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"changelog\": null
}"

GET/forms/{id}/versions/{versionId}/diff

Auth required

Diff form versions

Returns added/removed/modified fields between the URL `versionId` (newer) and the `against` query param (older).

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—
versionId	path	Yes	any	—
against	query	Yes	any	—

Responses

200Diff payload

Content-Type: application/json

{
  "base": {
    "id": "00000000-0000-4000-8000-000000000000",
    "versionNumber": 1,
    "schemaHash": "string"
  },
  "against": {
    "id": "00000000-0000-4000-8000-000000000000",
    "versionNumber": 1,
    "schemaHash": "string"
  },
  "diff": [
    {
      "kind": "added",
      "key": "string",
      "field": {
        "key": "string",
        "type": "string",
        "sectionKey": null,
        "sensitive": true,
        "editableBy": [
          "string"
        ],
        "visibleTo": [
          "string"
        ],
        "required": true
      }
    }
  ]
}

404Version not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/00000000-0000-4000-8000-000000000000/versions/00000000-0000-4000-8000-000000000000/diff?against=00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/forms/{id}/versions/{versionId}/publish

Auth required

Publish version

Publishes a draft version. Emits forms.form_version.published, advances form.current_published_version_id, and pins registry_version. Rejects with 422 no_op_publish if schema is unchanged.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—
versionId	path	Yes	any	—

Request body (application/json)

{
  "changelog": null
}

Responses

200Version published

Content-Type: application/json

{
  "versionId": "00000000-0000-4000-8000-000000000000",
  "versionNumber": 1,
  "updatedAt": "string"
}

404Version not found

Content-Type: application/json

{
  "error": "string"
}

409Version is frozen

Content-Type: application/json

{
  "error": "string"
}

422No-op or schema invalid

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/00000000-0000-4000-8000-000000000000/versions/00000000-0000-4000-8000-000000000000/publish" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"changelog\": null
}"

POST/forms/{id}/versions/fork

Auth required

Fork draft

Creates a new draft version. Optionally clones from `fromVersionId`. Rejects if a draft already exists (422 draft_already_exists).

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "fromVersionId": null
}

Responses

201Draft created

Content-Type: application/json

{
  "versionId": "00000000-0000-4000-8000-000000000000"
}

404Form not found

Content-Type: application/json

{
  "error": "string"
}

422Draft already exists

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/00000000-0000-4000-8000-000000000000/versions/fork" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"fromVersionId\": null
}"

GET/forms/distributions/{distributionId}

Auth required

Get distribution

Returns a single distribution scoped to the authenticated organization.

Parameters

Name	In	Required	Schema	Description
distributionId	path	Yes	any	—

Responses

200Distribution

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "formId": "00000000-0000-4000-8000-000000000000",
  "mode": "open",
  "status": "active",
  "publicSlug": null,
  "title": null,
  "defaultLocale": "string",
  "pinnedVersionId": null,
  "requireCustomerAuth": true,
  "allowMultipleSubmissions": true,
  "maxResponses": null,
  "responseCount": 1,
  "opensAt": null,
  "closesAt": null,
  "redirectUrl": null,
  "settings": null,
  "createdAt": "string",
  "updatedAt": "string"
}

404Distribution not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/distributions/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PATCH/forms/distributions/{distributionId}

Auth required

Update or close distribution

Updates mutable distribution fields. A body of { "status": "closed" } closes the distribution and emits forms.distribution.closed.

Parameters

Name	In	Required	Schema	Description
distributionId	path	Yes	any	—

Request body (application/json)

{
  "title": null,
  "maxResponses": null,
  "opensAt": null,
  "closesAt": null,
  "redirectUrl": null,
  "settings": null
}

Responses

200Distribution updated

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "updatedAt": "string"
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

404Distribution not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PATCH "https://hr.office.dac.systems/api/forms/distributions/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"title\": null,
  \"maxResponses\": null,
  \"opensAt\": null,
  \"closesAt\": null,
  \"redirectUrl\": null,
  \"settings\": null
}"

GET/forms/distributions/{distributionId}/invitations

Auth required

List invitations

Returns invitations for a distribution with recipient PII decrypted. Token hashes are never returned.

Parameters

Name	In	Required	Schema	Description
distributionId	path	Yes	any	—

Responses

200Invitation list

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "recipientEmail": null,
      "recipientName": null,
      "recipientRef": null,
      "role": null,
      "status": "pending",
      "locale": null,
      "sentAt": null,
      "openedAt": null,
      "startedAt": null,
      "submittedAt": null,
      "expiresAt": null,
      "sendCount": 1,
      "lastError": null,
      "createdAt": "string"
    }
  ],
  "total": 1
}

404Distribution not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/distributions/00000000-0000-4000-8000-000000000000/invitations" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/forms/distributions/{distributionId}/invitations

Auth required

Bulk-create invitations

Creates one invitation per recipient. For personal distributions, the response returns each invitation rawToken exactly once so the admin can build the personal link.

Parameters

Name	In	Required	Schema	Description
distributionId	path	Yes	any	—

Request body (application/json)

{
  "recipients": [
    {}
  ]
}

Responses

201Invitations created

Content-Type: application/json

{
  "invitations": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "rawToken": null
    }
  ]
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

404Distribution not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/distributions/00000000-0000-4000-8000-000000000000/invitations" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"recipients\": [
    {}
  ]
}"

DELETE/forms/distributions/{distributionId}/invitations/{invitationId}

Auth required

Revoke invitation

Soft-revokes an invitation — the row is retained and its status becomes revoked so a revoked token resolves to 410 (not 404).

Parameters

Name	In	Required	Schema	Description
distributionId	path	Yes	any	—
invitationId	path	Yes	any	—

Responses

200Invitation revoked

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000"
}

404Invitation not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/forms/distributions/00000000-0000-4000-8000-000000000000/invitations/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/forms/distributions/{distributionId}/invitations/{invitationId}/send

Auth required

Send invitation

Marks the invitation sent (sent_at, send_count += 1) and emits forms.invitation.sent so the email subscriber dispatches a reminder. Also the resend path.

Parameters

Name	In	Required	Schema	Description
distributionId	path	Yes	any	—
invitationId	path	Yes	any	—

Responses

200Invitation send tracked

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000"
}

404Invitation not found

Content-Type: application/json

{
  "error": "string"
}

409Invitation revoked or already submitted

Content-Type: application/json

{
  "error": "string"
}

422Invitation has no recipient email

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/distributions/00000000-0000-4000-8000-000000000000/invitations/00000000-0000-4000-8000-000000000000/send" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Business Rules

Showing 18 of 18 endpoints

POST/business_rules/execute

Auth required

Execute rules for given context

Manually executes applicable business rules for the specified entity type, event, and data. Supports dry-run mode to test rules without executing actions.

Request body (application/json)

{
  "entityType": "string",
  "dryRun": false
}

Responses

200Rules executed successfully

Content-Type: application/json

{
  "allowed": true,
  "executedRules": [
    {
      "ruleId": "string",
      "ruleName": "string",
      "conditionResult": true,
      "executionTime": 1
    }
  ],
  "totalExecutionTime": 1
}

400Invalid request payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

500Execution error

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/business_rules/execute" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityType\": \"string\",
  \"dryRun\": false
}"

POST/business_rules/execute/{ruleId}

Auth required

Execute a specific rule by its database UUID

Directly executes a specific business rule identified by its UUID, bypassing the normal entityType/eventType discovery mechanism. Useful for workflows and targeted rule execution.

Parameters

Name	In	Required	Schema	Description
ruleId	path	Yes	any	The database UUID of the business rule to execute

Request body (application/json)

{
  "dryRun": false
}

Responses

200Rule executed successfully

Content-Type: application/json

{
  "success": true,
  "ruleId": "string",
  "ruleName": "string",
  "conditionResult": true,
  "actionsExecuted": null,
  "executionTime": 1
}

400Invalid request payload or rule ID

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Rule not found

Content-Type: application/json

{
  "error": "string"
}

500Execution error

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/business_rules/execute/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"dryRun\": false
}"

GET/business_rules/logs

Auth required

List rule execution logs

Returns rule execution history for the current tenant and organization with filtering and pagination. Useful for audit trails and debugging.

Parameters

Name	In	Required	Schema	Description
id	query	No	any	—
page	query	No	any	—
pageSize	query	No	any	—
ruleId	query	No	any	—
entityId	query	No	any	—
entityType	query	No	any	—
executionResult	query	No	any	—
executedBy	query	No	any	—
executedAtFrom	query	No	any	—
executedAtTo	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—

Responses

200Rule execution logs collection

Content-Type: application/json

{
  "items": [
    {
      "id": "string",
      "ruleId": "string",
      "ruleName": "string",
      "ruleType": "string",
      "entityId": "00000000-0000-4000-8000-000000000000",
      "entityType": "string",
      "executionResult": "SUCCESS",
      "inputContext": null,
      "outputContext": null,
      "errorMessage": null,
      "executionTimeMs": 1,
      "executedAt": "string",
      "tenantId": "00000000-0000-4000-8000-000000000000",
      "organizationId": null,
      "executedBy": null
    }
  ],
  "total": 1,
  "totalPages": 1
}

400Invalid query parameters

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/business_rules/logs?page=1&pageSize=50&sortDir=desc" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/business_rules/logs/{id}

Auth required

Get execution log detail

Returns detailed information about a specific rule execution, including full context and results.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Log entry details

Content-Type: application/json

{
  "id": "string",
  "rule": {
    "id": "00000000-0000-4000-8000-000000000000",
    "ruleId": "string",
    "ruleName": "string",
    "ruleType": "string",
    "entityType": "string"
  },
  "entityId": "00000000-0000-4000-8000-000000000000",
  "entityType": "string",
  "executionResult": "SUCCESS",
  "inputContext": null,
  "outputContext": null,
  "errorMessage": null,
  "executionTimeMs": 1,
  "executedAt": "string",
  "tenantId": "00000000-0000-4000-8000-000000000000",
  "organizationId": null,
  "executedBy": null
}

400Invalid log id

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Log entry not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/business_rules/logs/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/business_rules/openmercato-call-options

Auth required

List OpenMercato call action options

Returns executable Open Mercato API endpoint options and safe API key profile metadata for business-rule actions.

Responses

200OpenMercato call options

Content-Type: application/json

{
  "endpoints": [
    {
      "id": "string",
      "path": "string",
      "method": "GET",
      "label": "string",
      "summary": null,
      "operationId": null
    }
  ],
  "apiKeys": [
    {
      "id": "string",
      "name": "string",
      "keyPrefix": "string",
      "organizationId": null,
      "organizationName": null,
      "roles": [
        {
          "id": "string",
          "name": null
        }
      ]
    }
  ]
}

400Tenant context missing

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Missing required features

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/business_rules/openmercato-call-options" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/business_rules/rules

Auth required

List business rules

Returns business rules for the current tenant and organization with filtering and pagination.

Parameters

Name	In	Required	Schema	Description
id	query	No	any	—
page	query	No	any	—
pageSize	query	No	any	—
search	query	No	any	—
ruleId	query	No	any	—
ruleType	query	No	any	—
entityType	query	No	any	—
eventType	query	No	any	—
enabled	query	No	any	—
ruleCategory	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—

Responses

200Business rules collection

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "ruleId": "string",
      "ruleName": "string",
      "description": null,
      "ruleType": "GUARD",
      "ruleCategory": null,
      "entityType": "string",
      "eventType": null,
      "enabled": true,
      "priority": 1,
      "version": 1,
      "effectiveFrom": null,
      "effectiveTo": null,
      "tenantId": "00000000-0000-4000-8000-000000000000",
      "organizationId": "00000000-0000-4000-8000-000000000000",
      "createdAt": "string",
      "updatedAt": "string"
    }
  ],
  "total": 1,
  "totalPages": 1
}

400Invalid query parameters

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/business_rules/rules?page=1&pageSize=50&sortDir=desc" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/business_rules/rules

Auth required

Create business rule

Creates a new business rule for the current tenant and organization.

Request body (application/json)

{
  "ruleId": "string",
  "ruleName": "string",
  "description": null,
  "ruleType": "GUARD",
  "ruleCategory": null,
  "entityType": "string",
  "eventType": null,
  "enabled": true,
  "priority": 100,
  "version": 1,
  "effectiveFrom": null,
  "effectiveTo": null,
  "tenantId": "string",
  "organizationId": "string",
  "createdBy": null,
  "conditionExpression": null,
  "successActions": null,
  "failureActions": null
}

Responses

201Business rule created

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000"
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/business_rules/rules" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"ruleId\": \"string\",
  \"ruleName\": \"string\",
  \"description\": null,
  \"ruleType\": \"GUARD\",
  \"ruleCategory\": null,
  \"entityType\": \"string\",
  \"eventType\": null,
  \"enabled\": true,
  \"priority\": 100,
  \"version\": 1,
  \"effectiveFrom\": null,
  \"effectiveTo\": null,
  \"tenantId\": \"string\",
  \"organizationId\": \"string\",
  \"createdBy\": null,
  \"conditionExpression\": null,
  \"successActions\": null,
  \"failureActions\": null
}"

PUT/business_rules/rules

Auth required

Update business rule

Updates an existing business rule.

Request body (application/json)

{
  "description": null,
  "ruleCategory": null,
  "eventType": null,
  "enabled": true,
  "priority": 100,
  "version": 1,
  "effectiveFrom": null,
  "effectiveTo": null,
  "conditionExpression": null,
  "successActions": null,
  "failureActions": null,
  "id": "string"
}

Responses

200Business rule updated

Content-Type: application/json

{
  "ok": true
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Business rule not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/business_rules/rules" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"description\": null,
  \"ruleCategory\": null,
  \"eventType\": null,
  \"enabled\": true,
  \"priority\": 100,
  \"version\": 1,
  \"effectiveFrom\": null,
  \"effectiveTo\": null,
  \"conditionExpression\": null,
  \"successActions\": null,
  \"failureActions\": null,
  \"id\": \"string\"
}"

DELETE/business_rules/rules

Auth required

Delete business rule

Soft deletes a business rule by identifier.

Parameters

Name	In	Required	Schema	Description
id	query	Yes	any	Business rule identifier

Responses

200Business rule deleted

Content-Type: application/json

{
  "ok": true
}

400Invalid identifier

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Business rule not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/business_rules/rules?id=00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/business_rules/rules/{id}

Auth required

Fetch business rule by ID

Returns complete details of a business rule including conditions and actions.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Business rule detail

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "ruleId": "string",
  "ruleName": "string",
  "description": null,
  "ruleType": "GUARD",
  "ruleCategory": null,
  "entityType": "string",
  "eventType": null,
  "successActions": null,
  "failureActions": null,
  "enabled": true,
  "priority": 1,
  "version": 1,
  "effectiveFrom": null,
  "effectiveTo": null,
  "tenantId": "00000000-0000-4000-8000-000000000000",
  "organizationId": "00000000-0000-4000-8000-000000000000",
  "createdBy": null,
  "updatedBy": null,
  "createdAt": "string",
  "updatedAt": "string"
}

400Invalid identifier

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Business rule not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/business_rules/rules/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/business_rules/sets

Auth required

List rule sets

Returns rule sets for the current tenant and organization with filtering and pagination.

Parameters

Name	In	Required	Schema	Description
id	query	No	any	—
page	query	No	any	—
pageSize	query	No	any	—
search	query	No	any	—
setId	query	No	any	—
enabled	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—

Responses

200Rule sets collection

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "setId": "string",
      "setName": "string",
      "description": null,
      "enabled": true,
      "tenantId": "00000000-0000-4000-8000-000000000000",
      "organizationId": "00000000-0000-4000-8000-000000000000",
      "createdBy": null,
      "updatedBy": null,
      "createdAt": "string",
      "updatedAt": "string"
    }
  ],
  "total": 1,
  "totalPages": 1
}

400Invalid query parameters

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/business_rules/sets?page=1&pageSize=50&sortDir=asc" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/business_rules/sets

Auth required

Create rule set

Creates a new rule set for organizing business rules.

Request body (application/json)

{
  "setId": "string",
  "setName": "string",
  "description": null,
  "enabled": true,
  "tenantId": "string",
  "organizationId": "string",
  "createdBy": null
}

Responses

201Rule set created

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000"
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/business_rules/sets" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"setId\": \"string\",
  \"setName\": \"string\",
  \"description\": null,
  \"enabled\": true,
  \"tenantId\": \"string\",
  \"organizationId\": \"string\",
  \"createdBy\": null
}"

PUT/business_rules/sets

Auth required

Update rule set

Updates an existing rule set.

Request body (application/json)

{
  "description": null,
  "enabled": true,
  "id": "string"
}

Responses

200Rule set updated

Content-Type: application/json

{
  "ok": true
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Rule set not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/business_rules/sets" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"description\": null,
  \"enabled\": true,
  \"id\": \"string\"
}"

DELETE/business_rules/sets

Auth required

Delete rule set

Soft deletes a rule set by identifier.

Parameters

Name	In	Required	Schema	Description
id	query	Yes	any	Rule set identifier

Responses

200Rule set deleted

Content-Type: application/json

{
  "ok": true
}

400Invalid identifier

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Rule set not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/business_rules/sets?id=00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/business_rules/sets/{id}

Auth required

Get rule set detail

Returns detailed information about a specific rule set, including all member rules.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Rule set details

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "setId": "string",
  "setName": "string",
  "description": null,
  "enabled": true,
  "tenantId": "00000000-0000-4000-8000-000000000000",
  "organizationId": "00000000-0000-4000-8000-000000000000",
  "createdBy": null,
  "updatedBy": null,
  "createdAt": "string",
  "updatedAt": "string",
  "members": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "ruleId": "00000000-0000-4000-8000-000000000000",
      "ruleName": "string",
      "ruleType": "string",
      "sequence": 1,
      "enabled": true
    }
  ]
}

400Invalid rule set id

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Rule set not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/business_rules/sets/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/business_rules/sets/{id}/members

Auth required

Add rule to set

Adds a business rule to a rule set with specified sequence and enabled state.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "ruleId": "00000000-0000-4000-8000-000000000000",
  "sequence": 0,
  "enabled": true
}

Responses

201Member added

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000"
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Rule set or rule not found

Content-Type: application/json

{
  "error": "string"
}

409Rule already in set

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/business_rules/sets/:id/members" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"ruleId\": \"00000000-0000-4000-8000-000000000000\",
  \"sequence\": 0,
  \"enabled\": true
}"

PUT/business_rules/sets/{id}/members

Auth required

Update set member

Updates sequence or enabled state of a rule set member.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "memberId": "00000000-0000-4000-8000-000000000000"
}

Responses

200Member updated

Content-Type: application/json

{
  "ok": true
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Member not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/business_rules/sets/:id/members" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"memberId\": \"00000000-0000-4000-8000-000000000000\"
}"

DELETE/business_rules/sets/{id}/members

Auth required

Remove rule from set

Removes a business rule from a rule set (hard delete).

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—
memberId	query	Yes	any	Member identifier

Responses

200Member removed

Content-Type: application/json

{
  "ok": true
}

400Invalid identifier

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Member not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/business_rules/sets/:id/members?memberId=00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Integrations

Showing 8 of 8 endpoints

GET/integrations

Auth required

List integrations

Returns a paginated collection of integrations.

Parameters

Name	In	Required	Schema	Description
q	query	No	any	—
category	query	No	any	—
bundleId	query	No	any	—
isEnabled	query	No	any	—
healthStatus	query	No	any	—
sort	query	No	any	—
order	query	No	any	—
page	query	No	any	—
pageSize	query	No	any	—
ids	query	No	any	Comma-separated list of record UUIDs to filter by (max 200).

Responses

200Paginated integrations

Content-Type: application/json

{
  "items": [
    {
      "id": "string",
      "title": "string",
      "description": null,
      "category": null,
      "tags": [
        "string"
      ],
      "hub": null,
      "providerKey": null,
      "bundleId": null,
      "author": null,
      "company": null,
      "version": null,
      "hasCredentials": true,
      "isEnabled": true,
      "apiVersion": null,
      "healthStatus": "healthy",
      "lastHealthCheckedAt": null,
      "lastHealthLatencyMs": null,
      "enabledAt": null,
      "analytics": {
        "lastActivityAt": null,
        "totalCount": 1,
        "errorCount": 1,
        "errorRate": 1,
        "dailyCounts": [
          1
        ]
      }
    }
  ],
  "total": 1,
  "totalPages": 1,
  "bundles": [
    {
      "id": "string",
      "title": "string",
      "description": "string",
      "icon": null,
      "integrationCount": 1,
      "enabledCount": 1
    }
  ]
}

Example

curl -X GET "https://hr.office.dac.systems/api/integrations?order=asc&page=1&pageSize=100" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/integrations/{id}

Auth required

Get integration detail

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/integrations/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/integrations/{id}/credentials

Auth required

Get or save integration credentials

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/integrations/:id/credentials" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/integrations/{id}/credentials

Auth required

Get or save integration credentials

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/integrations/:id/credentials" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/integrations/{id}/health

Auth required

Run health check for an integration

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

201Success response

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/integrations/:id/health" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/integrations/{id}/state

Auth required

Update integration state

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/integrations/:id/state" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/integrations/{id}/version

Auth required

Change integration API version

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/integrations/:id/version" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/integrations/logs

Auth required

List integration logs

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/integrations/logs" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Data Sync

Showing 17 of 17 endpoints

GET/data_sync/mappings

Auth required

List or create field mappings

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/data_sync/mappings" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/data_sync/mappings

Auth required

List or create field mappings

Responses

201Success response

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/data_sync/mappings" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/data_sync/mappings/{id}

Auth required

Get, update, or delete a field mapping

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/data_sync/mappings/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/data_sync/mappings/{id}

Auth required

Get, update, or delete a field mapping

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/data_sync/mappings/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

DELETE/data_sync/mappings/{id}

Auth required

Get, update, or delete a field mapping

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

204Success

No response body.

Example

curl -X DELETE "https://hr.office.dac.systems/api/data_sync/mappings/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/data_sync/options

Auth required

List data sync integration options

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/data_sync/options" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/data_sync/run

Auth required

Start a data sync run

Responses

201Success response

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/data_sync/run" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/data_sync/runs

Auth required

List sync runs

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/data_sync/runs" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/data_sync/runs/{id}

Auth required

Get sync run detail

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/data_sync/runs/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/data_sync/runs/{id}/cancel

Auth required

Cancel a running sync

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

201Success response

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/data_sync/runs/:id/cancel" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/data_sync/runs/{id}/retry

Auth required

Retry a failed sync run

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

201Success response

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/data_sync/runs/:id/retry" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/data_sync/schedules

Auth required

List or create sync schedules

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/data_sync/schedules" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/data_sync/schedules

Auth required

List or create sync schedules

Responses

201Success response

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/data_sync/schedules" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/data_sync/schedules/{id}

Auth required

Manage a sync schedule

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/data_sync/schedules/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/data_sync/schedules/{id}

Auth required

Manage a sync schedule

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/data_sync/schedules/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

DELETE/data_sync/schedules/{id}

Auth required

Manage a sync schedule

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

204Success

No response body.

Example

curl -X DELETE "https://hr.office.dac.systems/api/data_sync/schedules/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/data_sync/validate

Auth required

Validate sync connection

Responses

201Success response

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/data_sync/validate" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Progress

Showing 6 of 6 endpoints

GET/progress/active

Auth required

GET /progress/active

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/progress/active" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/progress/jobs

Auth required

List progressjobs

Returns a paginated collection of progressjobs scoped to the authenticated tenant.

Parameters

Name	In	Required	Schema	Description
status	query	No	any	—
jobType	query	No	any	—
parentJobId	query	No	any	—
includeCompleted	query	No	any	—
completedSince	query	No	any	—
page	query	No	any	—
pageSize	query	No	any	—
search	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—
ids	query	No	any	Comma-separated list of record UUIDs to filter by (max 200).

Responses

200Paginated progressjobs

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "jobType": "string",
      "name": "string",
      "description": null,
      "status": "string",
      "progressPercent": 1,
      "processedCount": 1,
      "totalCount": null,
      "etaSeconds": null,
      "cancellable": true,
      "startedAt": null,
      "finishedAt": null,
      "errorMessage": null,
      "createdAt": null,
      "tenantId": "00000000-0000-4000-8000-000000000000",
      "organizationId": null
    }
  ],
  "total": 1,
  "totalPages": 1
}

Example

curl -X GET "https://hr.office.dac.systems/api/progress/jobs?page=1&pageSize=20" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/progress/jobs

Auth required

Create progressjob

Creates a new progress job for tracking a long-running operation.

Request body (application/json)

{
  "jobType": "string",
  "name": "string",
  "cancellable": false
}

Responses

201ProgressJob created

Content-Type: application/json

{
  "id": null
}

Example

curl -X POST "https://hr.office.dac.systems/api/progress/jobs" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"jobType\": \"string\",
  \"name\": \"string\",
  \"cancellable\": false
}"

GET/progress/jobs/{id}

Auth required

GET /progress/jobs/{id}

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/progress/jobs/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/progress/jobs/{id}

Auth required

PUT /progress/jobs/{id}

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/progress/jobs/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

DELETE/progress/jobs/{id}

Auth required

DELETE /progress/jobs/{id}

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

204Success

No response body.

Example

curl -X DELETE "https://hr.office.dac.systems/api/progress/jobs/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Scheduler

Showing 8 of 8 endpoints

GET/scheduler/jobs

Auth required

List scheduledjobs

Returns a paginated collection of scheduledjobs scoped to the authenticated organization.

Parameters

Name	In	Required	Schema	Description
page	query	No	any	—
pageSize	query	No	any	—
id	query	No	any	—
search	query	No	any	—
scopeType	query	No	any	—
isEnabled	query	Yes	any	—
sourceType	query	No	any	—
sourceModule	query	No	any	—
sort	query	No	any	—
order	query	No	any	—
ids	query	No	any	Comma-separated list of record UUIDs to filter by (max 200).

Responses

200Paginated scheduledjobs

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "name": "string",
      "description": null,
      "scopeType": "system",
      "organizationId": null,
      "tenantId": null,
      "scheduleType": "cron",
      "scheduleValue": "string",
      "timezone": "string",
      "targetType": "queue",
      "targetQueue": null,
      "targetCommand": null,
      "targetPayload": null,
      "requireFeature": null,
      "isEnabled": true,
      "lastRunAt": null,
      "nextRunAt": null,
      "sourceType": "user",
      "sourceModule": null,
      "createdAt": "string",
      "updatedAt": "string"
    }
  ],
  "total": 1,
  "totalPages": 1
}

Example

curl -X GET "https://hr.office.dac.systems/api/scheduler/jobs?page=1&pageSize=20" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/scheduler/jobs

Auth required

Create scheduledjob

Creates a new scheduled job with cron or interval-based scheduling.

Request body (application/json)

{
  "name": "string",
  "description": null,
  "scopeType": "system",
  "organizationId": null,
  "tenantId": null,
  "scheduleType": "cron",
  "scheduleValue": "string",
  "timezone": "UTC",
  "targetType": "queue",
  "targetQueue": null,
  "targetCommand": null,
  "targetPayload": null,
  "requireFeature": null,
  "isEnabled": true
}

Responses

201ScheduledJob created

Content-Type: application/json

{
  "id": null
}

Example

curl -X POST "https://hr.office.dac.systems/api/scheduler/jobs" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"name\": \"string\",
  \"description\": null,
  \"scopeType\": \"system\",
  \"organizationId\": null,
  \"tenantId\": null,
  \"scheduleType\": \"cron\",
  \"scheduleValue\": \"string\",
  \"timezone\": \"UTC\",
  \"targetType\": \"queue\",
  \"targetQueue\": null,
  \"targetCommand\": null,
  \"targetPayload\": null,
  \"requireFeature\": null,
  \"isEnabled\": true
}"

PUT/scheduler/jobs

Auth required

Update scheduledjob

Updates an existing scheduled job by ID.

Request body (application/json)

{
  "id": "string",
  "description": null,
  "targetQueue": null,
  "targetCommand": null,
  "targetPayload": null,
  "requireFeature": null
}

Responses

200ScheduledJob updated

Content-Type: application/json

{
  "ok": true
}

Example

curl -X PUT "https://hr.office.dac.systems/api/scheduler/jobs" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"string\",
  \"description\": null,
  \"targetQueue\": null,
  \"targetCommand\": null,
  \"targetPayload\": null,
  \"requireFeature\": null
}"

DELETE/scheduler/jobs

Auth required

Delete scheduledjob

Deletes a scheduled job by ID.

Request body (application/json)

{
  "id": "string"
}

Responses

200ScheduledJob deleted

Content-Type: application/json

{
  "ok": true
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/scheduler/jobs" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"string\"
}"

GET/scheduler/jobs/{id}/executions

Get execution history for a schedule

Fetch recent executions from BullMQ for a scheduled job. Requires QUEUE_STRATEGY=async.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—
pageSize	query	No	any	—

Responses

200Execution history

Content-Type: application/json

{
  "items": [
    {
      "id": "string",
      "scheduleId": "00000000-0000-4000-8000-000000000000",
      "startedAt": "string",
      "finishedAt": null,
      "status": "running",
      "triggerType": "scheduled",
      "triggeredByUserId": null,
      "errorMessage": null,
      "errorStack": null,
      "durationMs": null,
      "queueJobId": "string",
      "queueName": "string",
      "attemptsMade": 1,
      "result": null
    }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1
}

400Local strategy not supported

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Schedule not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/scheduler/jobs/:id/executions?pageSize=20" \
  -H "Accept: application/json"

GET/scheduler/queue-jobs/{jobId}

Get BullMQ job details and logs

Fetch detailed information and logs for a queue job. Requires QUEUE_STRATEGY=async.

Parameters

Name	In	Required	Schema	Description
jobId	path	Yes	any	—
queue	query	Yes	any	—

Responses

200Job details and logs

Content-Type: application/json

{
  "id": "string",
  "name": "string",
  "state": "waiting",
  "progress": null,
  "returnvalue": null,
  "failedReason": null,
  "stacktrace": null,
  "attemptsMade": 1,
  "processedOn": null,
  "finishedOn": null,
  "logs": [
    "string"
  ]
}

400Invalid request or local strategy not supported

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Job not found

Content-Type: application/json

{
  "error": "string"
}

500Internal server error

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/scheduler/queue-jobs/:jobId?queue=string" \
  -H "Accept: application/json"

GET/scheduler/targets

List available queues and commands

Returns available queue names and scheduler-safe command IDs for schedule target selection.

Responses

200Available targets

Content-Type: application/json

{
  "queues": [
    {
      "value": "string",
      "label": "string"
    }
  ],
  "commands": [
    {
      "value": "string",
      "label": "string"
    }
  ]
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/scheduler/targets" \
  -H "Accept: application/json"

POST/scheduler/trigger

Manually trigger a schedule

Executes a scheduled job immediately, bypassing the scheduled time. Only works with async queue strategy. The attempt is audited against the calling user whether it succeeds, is refused, or fails, except when a before command interceptor blocks it before the command runs.

Request body (application/json)

{
  "id": "string"
}

Responses

200Schedule triggered successfully

Content-Type: application/json

{
  "ok": true,
  "jobId": "string",
  "message": "string"
}

400Invalid request or local strategy not supported

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Schedule not found

Content-Type: application/json

{
  "error": "string"
}

409Trigger deliberately blocked by a before command interceptor. The interceptor chooses the status (any 4xx/5xx) and may replace the body.

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/scheduler/trigger" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"string\"
}"

Messages

Showing 20 of 26 endpoints

GET/messages

Auth required

List messages

Parameters

Name	In	Required	Schema	Description
folder	query	No	any	—
status	query	No	any	—
type	query	No	any	—
visibility	query	No	any	—
sourceEntityType	query	No	any	—
sourceEntityId	query	No	any	—
externalEmail	query	No	any	—
hasObjects	query	No	any	—
hasAttachments	query	No	any	—
hasActions	query	No	any	—
senderId	query	No	any	—
search	query	No	any	—
since	query	No	any	—
page	query	No	any	—
pageSize	query	No	any	—

Responses

200Message list

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "type": "string",
      "visibility": null,
      "sourceEntityType": null,
      "sourceEntityId": null,
      "externalEmail": null,
      "externalName": null,
      "subject": "string",
      "bodyPreview": "string",
      "senderUserId": "00000000-0000-4000-8000-000000000000",
      "senderName": null,
      "senderEmail": null,
      "priority": "string",
      "status": "string",
      "hasObjects": true,
      "objectCount": 1,
      "hasAttachments": true,
      "attachmentCount": 1,
      "recipientCount": 1,
      "hasActions": true,
      "actionTaken": null,
      "sentAt": null,
      "readAt": null,
      "threadId": null
    }
  ],
  "page": 1,
  "pageSize": 1,
  "total": 1,
  "totalPages": 1
}

Example

curl -X GET "https://hr.office.dac.systems/api/messages?folder=inbox&page=1&pageSize=20" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/messages

Auth required

Compose a message

Request body (application/json)

{
  "type": "default",
  "visibility": null,
  "recipients": [],
  "subject": "",
  "body": "",
  "bodyFormat": "text",
  "priority": "normal",
  "sendViaEmail": false,
  "isDraft": false
}

Responses

201Message created

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "threadId": null
}

Example

curl -X POST "https://hr.office.dac.systems/api/messages" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"type\": \"default\",
  \"visibility\": null,
  \"recipients\": [],
  \"subject\": \"\",
  \"body\": \"\",
  \"bodyFormat\": \"text\",
  \"priority\": \"normal\",
  \"sendViaEmail\": false,
  \"isDraft\": false
}"

GET/messages/{id}

Auth required

Get message detail

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Message detail with actor-visible thread items only

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "updatedAt": null,
  "type": "string",
  "isDraft": true,
  "canEditDraft": true,
  "canArchive": true,
  "isArchived": true,
  "visibility": null,
  "sourceEntityType": null,
  "sourceEntityId": null,
  "externalEmail": null,
  "externalName": null,
  "typeDefinition": {
    "labelKey": "string",
    "icon": "string",
    "color": null,
    "allowReply": true,
    "allowForward": true,
    "ui": null
  },
  "threadId": null,
  "parentMessageId": null,
  "senderUserId": "00000000-0000-4000-8000-000000000000",
  "senderName": null,
  "senderEmail": null,
  "subject": "string",
  "body": "string",
  "bodyFormat": "text",
  "priority": "string",
  "sentAt": null,
  "actionData": null,
  "actionTaken": null,
  "actionTakenAt": null,
  "actionTakenByUserId": null,
  "recipients": [
    {
      "userId": "00000000-0000-4000-8000-000000000000",
      "type": "to",
      "status": "string",
      "readAt": null
    }
  ],
  "objects": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "entityModule": "string",
      "entityType": "string",
      "entityId": "00000000-0000-4000-8000-000000000000",
      "actionRequired": true,
      "actionType": null,
      "actionLabel": null,
      "snapshot": null,
      "preview": null
    }
  ],
  "thread": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "senderUserId": "00000000-0000-4000-8000-000000000000",
      "senderName": null,
      "senderEmail": null,
      "externalName": null,
      "externalEmail": null,
      "sourceEntityType": null,
      "body": "string",
      "sentAt": null
    }
  ],
  "isRead": true,
  "conversationArchived": true,
  "conversationAllUnread": true,
  "_channel": null,
  "_channelPayload": null,
  "_channelContact": null
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/messages/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PATCH/messages/{id}

Auth required

Update draft message

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "visibility": null
}

Responses

200Draft updated

Content-Type: application/json

{
  "ok": true
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

409Only drafts can be edited, or the draft was modified concurrently (optimistic lock conflict)

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PATCH "https://hr.office.dac.systems/api/messages/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"visibility\": null
}"

DELETE/messages/{id}

Auth required

Delete message for current sender/recipient context

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Message deleted

Content-Type: application/json

{
  "ok": true
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

409Message was modified concurrently (optimistic lock conflict)

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/messages/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/messages/{id}/actions/{actionId}

Auth required

Execute message action

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—
actionId	path	Yes	any	—

Request body (application/json)

"string"

Responses

200Action executed

Content-Type: application/json

{
  "ok": true,
  "actionId": "string"
}

403Access denied

Content-Type: application/json

"string"

404Action not found

Content-Type: application/json

"string"

409Action already taken, or the message was modified concurrently (optimistic lock conflict)

Content-Type: application/json

"string"

410Action expired

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/messages/:id/actions/:actionId" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/messages/{id}/archive

Auth required

Archive message

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Message archived

Content-Type: application/json

{
  "ok": true
}

403Access denied or sender-only message cannot be archived

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/messages/:id/archive" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

DELETE/messages/{id}/archive

Auth required

Unarchive message

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Message unarchived

Content-Type: application/json

{
  "ok": true
}

403Access denied or sender-only message cannot be unarchived

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/messages/:id/archive" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/messages/{id}/attachments

Auth required

List message attachments

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Attachments

Content-Type: application/json

{
  "attachments": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "fileName": "string",
      "fileSize": 1,
      "mimeType": "string",
      "url": "string"
    }
  ]
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/messages/:id/attachments" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/messages/{id}/attachments

Auth required

Link attachments to draft message

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "attachmentIds": [
    "00000000-0000-4000-8000-000000000000"
  ]
}

Responses

200Attachments linked

Content-Type: application/json

{
  "ok": true
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

409Only draft messages can be edited

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/messages/:id/attachments" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"attachmentIds\": [
    \"00000000-0000-4000-8000-000000000000\"
  ]
}"

DELETE/messages/{id}/attachments

Auth required

Unlink attachments from draft message

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{}

Responses

200Attachments unlinked

Content-Type: application/json

{
  "ok": true
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

409Only draft messages can be edited

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/messages/:id/attachments" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{}"

GET/messages/{id}/confirmation

Auth required

Read message confirmation status

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Confirmation status

Content-Type: application/json

{
  "messageId": "00000000-0000-4000-8000-000000000000",
  "confirmed": true,
  "confirmedAt": null,
  "confirmedByUserId": null
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/messages/:id/confirmation" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

DELETE/messages/{id}/conversation

Auth required

Delete conversation for current actor

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Conversation deleted

Content-Type: application/json

{
  "ok": true,
  "affectedCount": 1
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/messages/:id/conversation" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/messages/{id}/conversation/archive

Auth required

Archive conversation for current actor

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Conversation archived

Content-Type: application/json

{
  "ok": true,
  "affectedCount": 1
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/messages/:id/conversation/archive" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

DELETE/messages/{id}/conversation/archive

Auth required

Unarchive conversation for current actor

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Conversation unarchived

Content-Type: application/json

{
  "ok": true,
  "affectedCount": 1
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/messages/:id/conversation/archive" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/messages/{id}/conversation/read

Auth required

Mark entire conversation as read for current actor

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Conversation marked read

Content-Type: application/json

{
  "ok": true,
  "affectedCount": 1
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/messages/:id/conversation/read" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

DELETE/messages/{id}/conversation/read

Auth required

Mark entire conversation as unread for current actor

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Conversation marked unread

Content-Type: application/json

{
  "ok": true,
  "affectedCount": 1
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/messages/:id/conversation/read" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/messages/{id}/forward

Auth required

Forward a message and optionally include attachments from the forwarded conversation slice

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "recipients": [
    {
      "userId": "00000000-0000-4000-8000-000000000000",
      "type": "to"
    }
  ],
  "includeAttachments": true,
  "sendViaEmail": false
}

Responses

201Message forwarded

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000"
}

403Access denied

Content-Type: application/json

"string"

404Message not found

Content-Type: application/json

"string"

409Forward not allowed for message type

Content-Type: application/json

"string"

413Forward body exceeds maximum length

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/messages/:id/forward" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"recipients\": [
    {
      \"userId\": \"00000000-0000-4000-8000-000000000000\",
      \"type\": \"to\"
    }
  ],
  \"includeAttachments\": true,
  \"sendViaEmail\": false
}"

GET/messages/{id}/forward-preview

Auth required

Get forward preview for a message

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Forward preview generated

Content-Type: application/json

{
  "subject": "string",
  "body": "string"
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

413Forward body exceeds maximum length

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/messages/:id/forward-preview" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/messages/{id}/read

Auth required

Mark message as read

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Message marked read

Content-Type: application/json

{
  "ok": true
}

403Access denied

Content-Type: application/json

{
  "error": "string"
}

404Message not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/messages/:id/read" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Entity Translations

Showing 2 of 2 endpoints

GET/translations/locales

List supported translation locales

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/translations/locales" \
  -H "Accept: application/json"

PUT/translations/locales

Update supported translation locales

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/translations/locales" \
  -H "Accept: application/json"

Feature Toggles

Showing 12 of 12 endpoints

GET/feature_toggles/check/boolean

Auth required

Check if feature is enabled

Checks if a feature toggle is enabled for the current context.

Parameters

Name	In	Required	Schema	Description
identifier	query	Yes	any	Feature toggle identifier

Responses

200Feature status

Content-Type: application/json

{
  "enabled": true,
  "source": "override",
  "toggleId": "string",
  "identifier": "string",
  "tenantId": "string"
}

400Bad Request

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Tenant not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/feature_toggles/check/boolean?identifier=string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/feature_toggles/check/json

Auth required

Get json config

Gets the json configuration for a feature toggle.

Parameters

Name	In	Required	Schema	Description
identifier	query	Yes	any	Feature toggle identifier

Responses

200Json config

Content-Type: application/json

{
  "valueType": "json",
  "source": "override",
  "toggleId": "string",
  "identifier": "string",
  "tenantId": "string"
}

400Bad Request

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Tenant not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/feature_toggles/check/json?identifier=string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/feature_toggles/check/number

Auth required

Get number config

Gets the number configuration for a feature toggle.

Parameters

Name	In	Required	Schema	Description
identifier	query	Yes	any	Feature toggle identifier

Responses

200Number config

Content-Type: application/json

{
  "valueType": "number",
  "value": 1,
  "source": "override",
  "toggleId": "string",
  "identifier": "string",
  "tenantId": "string"
}

400Bad Request

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Tenant not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/feature_toggles/check/number?identifier=string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/feature_toggles/check/string

Auth required

Get string config

Gets the string configuration for a feature toggle.

Parameters

Name	In	Required	Schema	Description
identifier	query	Yes	any	Feature toggle identifier

Responses

200String config

Content-Type: application/json

{
  "valueType": "string",
  "value": "string",
  "source": "override",
  "toggleId": "string",
  "identifier": "string",
  "tenantId": "string"
}

400Bad Request

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Tenant not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/feature_toggles/check/string?identifier=string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/feature_toggles/global

Auth required

List global feature toggles

Returns all global feature toggles with filtering and pagination. Requires superadmin role.

Parameters

Name	In	Required	Schema	Description
page	query	No	any	Page number for pagination
pageSize	query	No	any	Number of items per page (max 200)
search	query	No	any	Case-insensitive search across identifier, name, description, and category
type	query	No	any	Filter by toggle type (boolean, string, number, json)
category	query	No	any	Filter by category (case-insensitive partial match)
name	query	No	any	Filter by name (case-insensitive partial match)
identifier	query	No	any	Filter by identifier (case-insensitive partial match)
sortField	query	No	any	Field to sort by
sortDir	query	No	any	Sort direction (ascending or descending)

Responses

200Feature toggles collection

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "identifier": "string",
      "name": "string",
      "description": null,
      "category": null,
      "type": "boolean",
      "defaultValue": null,
      "createdAt": null,
      "updatedAt": null
    }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1,
  "totalPages": 1
}

400Invalid query parameters

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Forbidden - superadmin role required

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/feature_toggles/global?page=1&pageSize=50" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/feature_toggles/global

Auth required

Create global feature toggle

Creates a new global feature toggle. Requires superadmin role.

Request body (application/json)

{
  "identifier": "string",
  "name": "string",
  "description": null,
  "category": null,
  "type": "boolean",
  "defaultValue": null
}

Responses

201Feature toggle created

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000"
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Forbidden - superadmin role required

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/feature_toggles/global" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"identifier\": \"string\",
  \"name\": \"string\",
  \"description\": null,
  \"category\": null,
  \"type\": \"boolean\",
  \"defaultValue\": null
}"

PUT/feature_toggles/global

Auth required

Update global feature toggle

Updates an existing global feature toggle. Requires superadmin role.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000",
  "description": null,
  "category": null,
  "defaultValue": null
}

Responses

200Feature toggle updated

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000"
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Forbidden - superadmin role required

Content-Type: application/json

{
  "error": "string"
}

404Feature toggle not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/feature_toggles/global" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\",
  \"description\": null,
  \"category\": null,
  \"defaultValue\": null
}"

DELETE/feature_toggles/global

Auth required

Delete global feature toggle

Soft deletes a global feature toggle by ID. Requires superadmin role.

Parameters

Name	In	Required	Schema	Description
id	query	Yes	any	Feature toggle identifier

Responses

200Feature toggle deleted

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000"
}

400Invalid identifier

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Forbidden - superadmin role required

Content-Type: application/json

{
  "error": "string"
}

404Feature toggle not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/feature_toggles/global?id=00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/feature_toggles/global/{id}

Auth required

Fetch feature toggle by ID

Returns complete details of a feature toggle.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Feature toggle detail

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "identifier": "string",
  "name": "string",
  "description": null,
  "category": null,
  "type": "boolean",
  "defaultValue": null,
  "createdAt": null,
  "updatedAt": null
}

400Invalid identifier

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Feature toggle not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/feature_toggles/global/:id" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/feature_toggles/global/{id}/override

Auth required

Fetch feature toggle override

Returns feature toggle override.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Feature toggle overrides

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "tenantName": "string",
  "tenantId": "00000000-0000-4000-8000-000000000000",
  "toggleType": "boolean",
  "updatedAt": null
}

400Invalid request

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

404Feature toggle not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/feature_toggles/global/:id/override" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/feature_toggles/overrides

Auth required

List overrides

Returns list of feature toggle overrides.

Parameters

Name	In	Required	Schema	Description
category	query	No	any	—
name	query	No	any	—
identifier	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—
page	query	No	any	—
pageSize	query	No	any	—

Responses

200List of overrides

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "toggleId": "00000000-0000-4000-8000-000000000000",
      "tenantName": "string",
      "tenantId": "00000000-0000-4000-8000-000000000000",
      "identifier": "string",
      "name": "string",
      "category": "string",
      "isOverride": true
    }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1,
  "totalPages": 1,
  "isSuperAdmin": true
}

400Invalid query parameters

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/feature_toggles/overrides?page=1&pageSize=25" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/feature_toggles/overrides

Auth required

Change override state

Enable, disable or inherit a feature toggle for a specific tenant.

Request body (application/json)

{
  "toggleId": "00000000-0000-4000-8000-000000000000",
  "isOverride": true
}

Responses

200Override updated

Content-Type: application/json

{
  "ok": true,
  "overrideToggleId": null
}

400Validation failed

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

404Not found

Content-Type: application/json

{
  "error": "string"
}

500Internal server error

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/feature_toggles/overrides" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"toggleId\": \"00000000-0000-4000-8000-000000000000\",
  \"isOverride\": true
}"

S3-Compatible Storage

Showing 6 of 6 endpoints

DELETE/storage-providers/s3/delete

Delete file from S3

Responses

204Success

No response body.

Example

curl -X DELETE "https://hr.office.dac.systems/api/storage-providers/s3/delete" \
  -H "Accept: application/json"

GET/storage-providers/s3/download

Download file from S3

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/storage-providers/s3/download" \
  -H "Accept: application/json"

GET/storage-providers/s3/list

List S3 objects

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/storage-providers/s3/list" \
  -H "Accept: application/json"

PUT/storage-providers/s3/signed-upload/:token

Upload through a bounded one-time compatibility URL

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/storage-providers/s3/signed-upload/:token" \
  -H "Accept: application/json"

POST/storage-providers/s3/signed-url

Generate S3 pre-signed URL

Responses

201Success response

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/storage-providers/s3/signed-url" \
  -H "Accept: application/json"

POST/storage-providers/s3/upload

Upload file to S3

Responses

201Success response

Content-Type: application/json

"string"

Example

curl -X POST "https://hr.office.dac.systems/api/storage-providers/s3/upload" \
  -H "Accept: application/json"

Google Sign-In

Showing 3 of 3 endpoints

GET/auth_google/callback

GET /auth_google/callback

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/auth_google/callback" \
  -H "Accept: application/json"

GET/auth_google/start

GET /auth_google/start

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/auth_google/start" \
  -H "Accept: application/json"

GET/auth_google/status

GET /auth_google/status

Responses

200Success response

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/auth_google/status" \
  -H "Accept: application/json"

Time off

Showing 20 of 26 endpoints

GET/hr_time_off/company-days

Auth required

List company days off

Returns a paginated collection of company days off.

Parameters

Name	In	Required	Schema	Description
page	query	No	any	—
pageSize	query	No	any	—
id	query	No	any	—
from	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—
ids	query	No	any	Comma-separated list of record UUIDs to filter by (max 200).

Responses

200Paginated company days off

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "date": "string",
      "label": "string",
      "updated_at": "string"
    }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1,
  "totalPages": 1
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_time_off/company-days?page=1&pageSize=50" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/hr_time_off/company-days

Auth required

Create company day off

Adds a company day off. Existing requests are not recounted.

Request body (application/json)

{
  "date": "string",
  "label": "string"
}

Responses

201Company day off created

Content-Type: application/json

{
  "id": null
}

Example

curl -X POST "https://hr.office.dac.systems/api/hr_time_off/company-days" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"date\": \"string\",
  \"label\": \"string\"
}"

PUT/hr_time_off/company-days

Auth required

Update company day off

Changes a company day off.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000"
}

Responses

200Company day off updated

Content-Type: application/json

{
  "ok": true
}

Example

curl -X PUT "https://hr.office.dac.systems/api/hr_time_off/company-days" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\"
}"

DELETE/hr_time_off/company-days

Auth required

Delete company day off

Removes a company day off.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000"
}

Responses

200Company day off deleted

Content-Type: application/json

{
  "ok": true
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/hr_time_off/company-days" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\"
}"

GET/hr_time_off/employment-types/options

Auth required

Employment types for leave type rules

Responses

200Dictionary values and labels.

Content-Type: application/json

{
  "items": [
    {
      "value": "string",
      "label": "string"
    }
  ]
}

400Invalid input or no single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Not allowed for this caller or stage

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_time_off/employment-types/options" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/hr_time_off/me/balances

Auth required

Balances of the signed-in employee

Responses

200Pools with days, adjustment, used, reserved and left.

Content-Type: application/json

{
  "memberId": null,
  "ownership": "tomhrm",
  "sandbox": true,
  "isAdmin": true,
  "pools": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "member": null,
      "type": {
        "id": "00000000-0000-4000-8000-000000000000",
        "name": "string",
        "code": "string"
      },
      "validFrom": "string",
      "validTo": "string",
      "balance": {
        "poolId": "00000000-0000-4000-8000-000000000000",
        "days": 1,
        "adjustment": 1,
        "used": 1,
        "reserved": 1,
        "left": 1
      },
      "adjustmentNote": null,
      "note": null,
      "source": "tomhrm",
      "updatedAt": "string"
    }
  ]
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_time_off/me/balances" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/hr_time_off/people/options

Auth required

Active people for pickers

Parameters

Name	In	Required	Schema	Description
search	query	No	any	—
ids	query	No	any	—

Responses

200Up to 50 options.

Content-Type: application/json

{
  "items": [
    {
      "value": "00000000-0000-4000-8000-000000000000",
      "label": "string"
    }
  ]
}

400Invalid input or no single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Not allowed for this caller or stage

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_time_off/people/options" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/hr_time_off/pools

Auth required

List leave pools

Returns a paginated collection of leave pools.

Parameters

Name	In	Required	Schema	Description
page	query	No	any	—
pageSize	query	No	any	—
id	query	No	any	—
memberId	query	No	any	—
typeId	query	No	any	—
validOn	query	No	any	—
withAdjustment	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—
ids	query	No	any	Comma-separated list of record UUIDs to filter by (max 200).

Responses

200Paginated leave pools

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "member_id": "00000000-0000-4000-8000-000000000000",
      "member_name": null,
      "type_id": "00000000-0000-4000-8000-000000000000",
      "type_name": null,
      "valid_from": "string",
      "valid_to": "string",
      "days": "string",
      "adjustment_days": "string",
      "adjustment_note": null,
      "note": null,
      "source": "string",
      "used": 1,
      "reserved": 1,
      "left": 1,
      "updated_at": "string"
    }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1,
  "totalPages": 1
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_time_off/pools?page=1&pageSize=50" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/hr_time_off/pools

Auth required

Create leave pool

Grants days of a type to a person for a period.

Request body (application/json)

{
  "memberId": "00000000-0000-4000-8000-000000000000",
  "typeId": "00000000-0000-4000-8000-000000000000",
  "validFrom": "string",
  "validTo": "string",
  "days": 1,
  "adjustmentDays": 0,
  "adjustmentNote": null,
  "note": null
}

Responses

201Leave pool created

Content-Type: application/json

{
  "id": null
}

Example

curl -X POST "https://hr.office.dac.systems/api/hr_time_off/pools" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"memberId\": \"00000000-0000-4000-8000-000000000000\",
  \"typeId\": \"00000000-0000-4000-8000-000000000000\",
  \"validFrom\": \"string\",
  \"validTo\": \"string\",
  \"days\": 1,
  \"adjustmentDays\": 0,
  \"adjustmentNote\": null,
  \"note\": null
}"

PUT/hr_time_off/pools

Auth required

Update leave pool

Changes a pool; days cannot drop below what its requests use (422 pool_in_use).

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000",
  "adjustmentNote": null,
  "note": null
}

Responses

200Leave pool updated

Content-Type: application/json

{
  "ok": true
}

Example

curl -X PUT "https://hr.office.dac.systems/api/hr_time_off/pools" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\",
  \"adjustmentNote\": null,
  \"note\": null
}"

DELETE/hr_time_off/pools

Auth required

Delete leave pool

Deletes a pool without requests.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000"
}

Responses

200Leave pool deleted

Content-Type: application/json

{
  "ok": true
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/hr_time_off/pools" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\"
}"

GET/hr_time_off/reports/monthly

Auth required

Approved leave per person and type in one month

Days of a request inside the month are its stored days; a request crossing the month boundary counts the working days of its part in the month.

Parameters

Name	In	Required	Schema	Description
month	query	Yes	any	—

Responses

200One row per person and leave type.

Content-Type: application/json

{
  "month": "string",
  "from": "string",
  "to": "string",
  "workingDays": 1,
  "items": [
    {
      "member": {
        "id": "00000000-0000-4000-8000-000000000000",
        "displayName": "string",
        "isActive": true
      },
      "department": null,
      "employmentType": null,
      "type": {
        "id": "00000000-0000-4000-8000-000000000000",
        "name": "string"
      },
      "days": 1,
      "requests": 1,
      "periods": [
        {
          "startDate": "string",
          "endDate": "string",
          "days": 1
        }
      ]
    }
  ]
}

400Invalid input or no single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Not allowed for this caller or stage

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_time_off/reports/monthly?month=string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/hr_time_off/requests

Auth required

List leave requests

scope=mine|to_decide|team|all; `all` needs hr_time_off.admin. Each item carries the actions the caller may take.

Parameters

Name	In	Required	Schema	Description
scope	query	No	any	—
memberId	query	No	any	—
typeId	query	No	any	—
status	query	No	any	—
from	query	No	any	—
to	query	No	any	—
page	query	No	any	—
pageSize	query	No	any	—

Responses

200A page of requests.

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "member": null,
      "type": null,
      "startDate": "string",
      "endDate": "string",
      "days": 1,
      "status": "pending_manager",
      "substitute": null,
      "manager": null,
      "decidedAs": null,
      "managerDecidedAt": null,
      "adminDecidedAt": null,
      "cancelledAt": null,
      "source": "tomhrm",
      "createdAt": "string",
      "updatedAt": "string",
      "note": null,
      "decisionComment": null
    }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1
}

400Invalid input or no single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Not allowed for this caller or stage

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_time_off/requests?scope=mine&page=1&pageSize=25" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/hr_time_off/requests

Auth required

Submit a leave request

For yourself; a leave administrator may pass memberId and enter HR-only types (saved as approved).

Request body (application/json)

{
  "typeId": "00000000-0000-4000-8000-000000000000",
  "startDate": "string",
  "endDate": "string",
  "note": null,
  "substituteMemberId": null
}

Responses

201Created.

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "status": "pending_manager",
  "days": 1
}

400Invalid input or no single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Not allowed for this caller or stage

Content-Type: application/json

{
  "error": "string"
}

404Request not found or not visible

Content-Type: application/json

{
  "error": "string"
}

409tomhrm_is_master, invalid_transition or stale version

Content-Type: application/json

{
  "error": "string"
}

422Business rule violated (no_working_days, overlap, no_pool, insufficient_balance, type_not_allowed, note_required, invalid_substitute, too_far_in_past)

Content-Type: application/json

{
  "error": "string"
}

503ownership_unknown: the ownership flag cannot be read

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/hr_time_off/requests" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"typeId\": \"00000000-0000-4000-8000-000000000000\",
  \"startDate\": \"string\",
  \"endDate\": \"string\",
  \"note\": null,
  \"substituteMemberId\": null
}"

GET/hr_time_off/requests/{id}

Auth required

Get a leave request

Visible to the requester, their manager and superior, and leave administrators; 404 for everyone else.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200The request with the note and the actions the caller may take.

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "member": null,
  "type": null,
  "startDate": "string",
  "endDate": "string",
  "days": 1,
  "status": "pending_manager",
  "substitute": null,
  "manager": null,
  "decidedAs": null,
  "managerDecidedAt": null,
  "adminDecidedAt": null,
  "cancelledAt": null,
  "source": "tomhrm",
  "createdAt": "string",
  "updatedAt": "string",
  "note": null,
  "decisionComment": null
}

400Invalid input or no single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Not allowed for this caller or stage

Content-Type: application/json

{
  "error": "string"
}

404Request not found or not visible

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_time_off/requests/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/hr_time_off/requests/{id}

Auth required

Edit a pending request (requester only)

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "note": null,
  "substituteMemberId": null
}

Responses

200Updated; the request returns to its first stage.

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "status": "pending_manager",
  "days": 1
}

400Invalid input or no single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Not allowed for this caller or stage

Content-Type: application/json

{
  "error": "string"
}

404Request not found or not visible

Content-Type: application/json

{
  "error": "string"
}

409tomhrm_is_master, invalid_transition or stale version

Content-Type: application/json

{
  "error": "string"
}

422Business rule violated (no_working_days, overlap, no_pool, insufficient_balance, type_not_allowed, note_required, invalid_substitute, too_far_in_past)

Content-Type: application/json

{
  "error": "string"
}

503ownership_unknown: the ownership flag cannot be read

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/hr_time_off/requests/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"note\": null,
  \"substituteMemberId\": null
}"

POST/hr_time_off/requests/{id}/cancel

Auth required

Cancel a request

The requester while pending or before the first day; a leave administrator at any time. Days return to the balance.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "comment": null
}

Responses

200New status.

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "status": "pending_manager",
  "days": 1
}

400Invalid input or no single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Not allowed for this caller or stage

Content-Type: application/json

{
  "error": "string"
}

404Request not found or not visible

Content-Type: application/json

{
  "error": "string"
}

409tomhrm_is_master, invalid_transition or stale version

Content-Type: application/json

{
  "error": "string"
}

422Business rule violated (no_working_days, overlap, no_pool, insufficient_balance, type_not_allowed, note_required, invalid_substitute, too_far_in_past)

Content-Type: application/json

{
  "error": "string"
}

503ownership_unknown: the ownership flag cannot be read

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/hr_time_off/requests/00000000-0000-4000-8000-000000000000/cancel" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"comment\": null
}"

POST/hr_time_off/requests/{id}/decision

Auth required

Approve or reject a request

Stage 1: the routed manager or a leave administrator; stage 2: a leave administrator. Nobody decides their own request.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "decision": "approve",
  "comment": null
}

Responses

200New status.

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "status": "pending_manager",
  "days": 1
}

400Invalid input or no single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Not allowed for this caller or stage

Content-Type: application/json

{
  "error": "string"
}

404Request not found or not visible

Content-Type: application/json

{
  "error": "string"
}

409tomhrm_is_master, invalid_transition or stale version

Content-Type: application/json

{
  "error": "string"
}

422Business rule violated (no_working_days, overlap, no_pool, insufficient_balance, type_not_allowed, note_required, invalid_substitute, too_far_in_past)

Content-Type: application/json

{
  "error": "string"
}

503ownership_unknown: the ownership flag cannot be read

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/hr_time_off/requests/00000000-0000-4000-8000-000000000000/decision" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"decision\": \"approve\",
  \"comment\": null
}"

POST/hr_time_off/requests/{id}/end-early

Auth required

Shorten approved leave (HR)

Moves the end date earlier and recounts the days.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "endDate": "string"
}

Responses

200New status.

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "status": "pending_manager",
  "days": 1
}

400Invalid input or no single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Not allowed for this caller or stage

Content-Type: application/json

{
  "error": "string"
}

404Request not found or not visible

Content-Type: application/json

{
  "error": "string"
}

409tomhrm_is_master, invalid_transition or stale version

Content-Type: application/json

{
  "error": "string"
}

422Business rule violated (no_working_days, overlap, no_pool, insufficient_balance, type_not_allowed, note_required, invalid_substitute, too_far_in_past)

Content-Type: application/json

{
  "error": "string"
}

503ownership_unknown: the ownership flag cannot be read

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/hr_time_off/requests/00000000-0000-4000-8000-000000000000/end-early" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"endDate\": \"string\"
}"

GET/hr_time_off/team

Auth required

Balances and upcoming leave of people I manage or lead

Responses

200One row per person.

Content-Type: application/json

{
  "items": [
    {
      "member": {
        "id": "00000000-0000-4000-8000-000000000000",
        "displayName": "string"
      },
      "relation": "manager",
      "pools": [
        {
          "id": "00000000-0000-4000-8000-000000000000",
          "member": null,
          "type": {
            "id": "00000000-0000-4000-8000-000000000000",
            "name": "string",
            "code": "string"
          },
          "validFrom": "string",
          "validTo": "string",
          "balance": {
            "poolId": "00000000-0000-4000-8000-000000000000",
            "days": 1,
            "adjustment": 1,
            "used": 1,
            "reserved": 1,
            "left": 1
          },
          "adjustmentNote": null,
          "note": null,
          "source": "tomhrm",
          "updatedAt": "string"
        }
      ],
      "upcoming": [
        {
          "id": "00000000-0000-4000-8000-000000000000",
          "startDate": "string",
          "endDate": "string",
          "days": 1,
          "status": "string",
          "typeName": "string"
        }
      ]
    }
  ]
}

400Invalid input or no single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Not allowed for this caller or stage

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_time_off/team" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Auth

Showing 1 of 1 endpoints

GET/auth/users/consents

Auth required

List user consents

Returns all consent records for a given user, with integrity verification status.

Parameters

Name	In	Required	Schema	Description
userId	query	Yes	any	—

Responses

200Consent list returned

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/auth/users/consents?userId=00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Configs

Showing 8 of 8 endpoints

GET/configs/cache

Auth required

Get cache statistics

Returns detailed cache statistics including total entries and breakdown by cache segments. Requires cache service to be available.

Responses

200Cache statistics

Content-Type: application/json

{
  "generatedAt": "string",
  "totalKeys": 1,
  "segments": [
    {
      "segment": "string",
      "resource": null,
      "method": null,
      "path": null,
      "keyCount": 1,
      "keys": [
        "string"
      ]
    }
  ]
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

500Failed to resolve cache stats

Content-Type: application/json

{
  "error": "string"
}

503Cache service unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/configs/cache" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/configs/cache

Auth required

Purge cache

Purges cache entries. Supports two actions: purgeAll (clears entire cache) or purgeSegment (clears specific segment). Returns updated cache statistics after purge.

Request body (application/json)

{
  "action": "purgeAll"
}

Responses

200Cache segment cleared successfully

Content-Type: application/json

{
  "action": "purgeSegment",
  "segment": "string",
  "deleted": 1,
  "stats": {
    "generatedAt": "string",
    "totalKeys": 1,
    "segments": [
      {
        "segment": "string",
        "resource": null,
        "method": null,
        "path": null,
        "keyCount": 1,
        "keys": [
          "string"
        ]
      }
    ]
  }
}

400Invalid request - missing segment identifier for purgeSegment action

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

500Failed to purge cache

Content-Type: application/json

{
  "error": "string"
}

503Cache service unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/configs/cache" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"action\": \"purgeAll\"
}"

GET/configs/module-telemetry

Auth required

Get module resource usage telemetry

Returns in-process module resource attribution for API routes, event subscribers, and queue workers.

Responses

200Module resource usage report

Content-Type: application/json

{
  "generatedAt": "string",
  "startedAt": "string",
  "enabled": true,
  "bucketIntervalMs": 1,
  "totals": {
    "modules": 1,
    "operations": 1,
    "calls": 1,
    "errors": 1,
    "totalDurationMs": 1,
    "totalCpuMs": 1,
    "positiveHeapDeltaBytes": 1,
    "positiveRssDeltaBytes": 1
  },
  "thresholds": {
    "p95DurationMs": 1,
    "cpuMs": 1,
    "positiveHeapDeltaBytes": 1,
    "positiveRssDeltaBytes": 1,
    "errors": 1
  },
  "modules": [
    {
      "moduleId": "string",
      "calls": 1,
      "errors": 1,
      "totalDurationMs": 1,
      "p95DurationMs": 1,
      "totalCpuMs": 1,
      "positiveHeapDeltaBytes": 1,
      "positiveRssDeltaBytes": 1,
      "surfaces": [
        {
          "surface": "api",
          "calls": 1,
          "errors": 1,
          "totalDurationMs": 1,
          "p95DurationMs": 1,
          "totalCpuMs": 1,
          "positiveHeapDeltaBytes": 1,
          "positiveRssDeltaBytes": 1
        }
      ],
      "topOperations": [
        {
          "moduleId": "string",
          "surface": "api",
          "operation": "string",
          "resourceId": null,
          "calls": 1,
          "errors": 1,
          "totalDurationMs": 1,
          "maxDurationMs": 1,
          "p95DurationMs": 1,
          "totalCpuUserMs": 1,
          "totalCpuSystemMs": 1,
          "maxCpuMs": 1,
          "totalHeapDeltaBytes": 1,
          "positiveHeapDeltaBytes": 1,
          "maxHeapDeltaBytes": 1,
          "totalRssDeltaBytes": 1,
          "positiveRssDeltaBytes": 1,
          "maxRssDeltaBytes": 1,
          "firstSeenAt": "string",
          "lastSeenAt": "string"
        }
      ],
      "candidateReasons": [
        "string"
      ]
    }
  ],
  "candidates": [
    {
      "moduleId": "string",
      "calls": 1,
      "errors": 1,
      "totalDurationMs": 1,
      "p95DurationMs": 1,
      "totalCpuMs": 1,
      "positiveHeapDeltaBytes": 1,
      "positiveRssDeltaBytes": 1,
      "surfaces": [
        {
          "surface": "api",
          "calls": 1,
          "errors": 1,
          "totalDurationMs": 1,
          "p95DurationMs": 1,
          "totalCpuMs": 1,
          "positiveHeapDeltaBytes": 1,
          "positiveRssDeltaBytes": 1
        }
      ],
      "topOperations": [
        {
          "moduleId": "string",
          "surface": "api",
          "operation": "string",
          "resourceId": null,
          "calls": 1,
          "errors": 1,
          "totalDurationMs": 1,
          "maxDurationMs": 1,
          "p95DurationMs": 1,
          "totalCpuUserMs": 1,
          "totalCpuSystemMs": 1,
          "maxCpuMs": 1,
          "totalHeapDeltaBytes": 1,
          "positiveHeapDeltaBytes": 1,
          "maxHeapDeltaBytes": 1,
          "totalRssDeltaBytes": 1,
          "positiveRssDeltaBytes": 1,
          "maxRssDeltaBytes": 1,
          "firstSeenAt": "string",
          "lastSeenAt": "string"
        }
      ],
      "candidateReasons": [
        "string"
      ]
    }
  ],
  "buckets": [
    {
      "bucketStart": "string",
      "bucketEnd": "string",
      "bucketIntervalMs": 1,
      "stage": "startup",
      "partial": true,
      "totals": {
        "modules": 1,
        "calls": 1,
        "errors": 1,
        "totalDurationMs": 1,
        "totalCpuMs": 1,
        "positiveHeapDeltaBytes": 1,
        "positiveRssDeltaBytes": 1
      },
      "modules": [
        {
          "moduleId": "string",
          "calls": 1,
          "errors": 1,
          "totalDurationMs": 1,
          "p95DurationMs": 1,
          "totalCpuMs": 1,
          "positiveHeapDeltaBytes": 1,
          "positiveRssDeltaBytes": 1,
          "surfaces": [
            {
              "surface": "api",
              "calls": 1,
              "errors": 1,
              "totalDurationMs": 1,
              "p95DurationMs": 1,
              "totalCpuMs": 1,
              "positiveHeapDeltaBytes": 1,
              "positiveRssDeltaBytes": 1
            }
          ],
          "topOperations": [
            {
              "moduleId": "string",
              "surface": "api",
              "operation": "string",
              "resourceId": null,
              "calls": 1,
              "errors": 1,
              "totalDurationMs": 1,
              "maxDurationMs": 1,
              "p95DurationMs": 1,
              "totalCpuUserMs": 1,
              "totalCpuSystemMs": 1,
              "maxCpuMs": 1,
              "totalHeapDeltaBytes": 1,
              "positiveHeapDeltaBytes": 1,
              "maxHeapDeltaBytes": 1,
              "totalRssDeltaBytes": 1,
              "positiveRssDeltaBytes": 1,
              "maxRssDeltaBytes": 1,
              "firstSeenAt": "string",
              "lastSeenAt": "string"
            }
          ],
          "candidateReasons": [
            "string"
          ]
        }
      ]
    }
  ]
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/configs/module-telemetry" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

DELETE/configs/module-telemetry

Auth required

Clear module telemetry data

Development-only endpoint that clears in-memory module telemetry and local process telemetry files.

Responses

200Module telemetry cleared

Content-Type: application/json

{
  "cleared": true
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Forbidden outside development mode

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/configs/module-telemetry" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/configs/system-status

Auth required

Get system health status

Returns comprehensive system health information including environment details, version, resource usage, and service connectivity status.

Responses

200System status snapshot

Content-Type: application/json

{
  "generatedAt": "string",
  "runtimeMode": "development",
  "categories": [
    {
      "key": "profiling",
      "labelKey": "string",
      "descriptionKey": null,
      "items": [
        {
          "key": "string",
          "category": "profiling",
          "kind": "boolean",
          "labelKey": "string",
          "descriptionKey": "string",
          "docUrl": null,
          "defaultValue": null,
          "state": "enabled",
          "value": null,
          "normalizedValue": null
        }
      ]
    }
  ]
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

500Failed to load system status

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/configs/system-status" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/configs/system-status

Auth required

Clear system cache

Purges the entire cache for the current tenant. Useful for troubleshooting or forcing fresh data loading.

Responses

200Cache cleared successfully

Content-Type: application/json

{
  "cleared": true
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

500Failed to purge cache

Content-Type: application/json

{
  "error": "string"
}

503Cache service unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/configs/system-status" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/configs/upgrade-actions

Auth required

List pending upgrade actions

Returns a list of pending upgrade actions for the current version. These are one-time setup tasks that need to be executed after upgrading to a new version. Requires organization and tenant context.

Responses

200List of pending upgrade actions

Content-Type: application/json

{
  "version": "string",
  "actions": [
    {
      "id": "string",
      "version": "string",
      "message": "string",
      "ctaLabel": "string",
      "successMessage": "string",
      "loadingLabel": "string"
    }
  ]
}

400Missing organization or tenant context

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

500Failed to load upgrade actions

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/configs/upgrade-actions" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/configs/upgrade-actions

Auth required

Execute upgrade action

Executes a specific upgrade action by ID. Typically used for one-time setup tasks like seeding example data after version upgrade. Returns execution status and localized success message.

Request body (application/json)

{
  "actionId": "string"
}

Responses

200Upgrade action executed successfully

Content-Type: application/json

{
  "status": "string",
  "message": "string",
  "version": "string"
}

400Invalid request body or missing context

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Upgrade actions are disabled

Content-Type: application/json

{
  "error": "string"
}

500Failed to execute upgrade action

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/configs/upgrade-actions" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"actionId\": \"string\"
}"

Dashboards

Showing 10 of 10 endpoints

GET/dashboards/layout

Auth required

Load the current dashboard layout

Returns the saved widget layout together with the widgets the current user is allowed to place.

Responses

200Current dashboard layout and available widgets.

Content-Type: application/json

{
  "layout": {
    "items": [
      {
        "id": "00000000-0000-4000-8000-000000000000",
        "widgetId": "string",
        "order": 1
      }
    ]
  },
  "allowedWidgetIds": [
    "string"
  ],
  "canConfigure": true,
  "context": {
    "userId": "00000000-0000-4000-8000-000000000000",
    "tenantId": null,
    "organizationId": null,
    "userName": null,
    "userEmail": null,
    "userLabel": "string"
  },
  "widgets": [
    {
      "id": "string",
      "title": "string",
      "description": null,
      "defaultSize": "sm",
      "defaultEnabled": true,
      "defaultSettings": null,
      "features": [
        "string"
      ],
      "moduleId": "string",
      "icon": null,
      "loaderKey": "string",
      "supportsRefresh": true
    }
  ]
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/dashboards/layout" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/dashboards/layout

Auth required

Persist dashboard layout changes

Saves the provided widget ordering, sizes, and settings for the current user.

Request body (application/json)

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "widgetId": "string",
      "order": 1
    }
  ]
}

Responses

200Layout updated successfully.

Content-Type: application/json

{
  "ok": true
}

400Invalid layout payload

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Missing dashboards.configure feature

Content-Type: application/json

{
  "error": "string"
}

503Widget registry unavailable — the layout was not saved

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/dashboards/layout" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"items\": [
    {
      \"id\": \"00000000-0000-4000-8000-000000000000\",
      \"widgetId\": \"string\",
      \"order\": 1
    }
  ]
}"

PATCH/dashboards/layout/{itemId}

Auth required

Update a dashboard layout item

Adjusts the size or settings for a single widget within the dashboard layout.

Parameters

Name	In	Required	Schema	Description
itemId	path	Yes	any	—

Request body (application/json)

{}

Responses

200Layout item updated.

Content-Type: application/json

{
  "ok": true
}

400Invalid payload or missing item id

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Missing dashboards.configure feature

Content-Type: application/json

{
  "error": "string"
}

404Item not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PATCH "https://hr.office.dac.systems/api/dashboards/layout/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{}"

GET/dashboards/roles/widgets

Auth required

Fetch widget assignments for a role

Returns the widgets explicitly assigned to the given role together with the evaluation scope.

Parameters

Name	In	Required	Schema	Description
roleId	query	Yes	any	—
tenantId	query	No	any	—
organizationId	query	No	any	—

Responses

200Current widget configuration for the role.

Content-Type: application/json

{
  "widgetIds": [
    "string"
  ],
  "hasCustom": true,
  "scope": {
    "tenantId": null,
    "organizationId": null
  }
}

400Missing role identifier

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Insufficient permissions to manage role widgets

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/dashboards/roles/widgets?roleId=00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/dashboards/roles/widgets

Auth required

Update widgets assigned to a role

Persists the widget list for a role within the provided tenant and organization scope.

Request body (application/json)

{
  "roleId": "00000000-0000-4000-8000-000000000000",
  "widgetIds": [
    "string"
  ]
}

Responses

200Widgets updated successfully.

Content-Type: application/json

{
  "ok": true,
  "widgetIds": [
    "string"
  ]
}

400Invalid payload or unknown widgets

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Insufficient permissions to manage role widgets

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/dashboards/roles/widgets" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"roleId\": \"00000000-0000-4000-8000-000000000000\",
  \"widgetIds\": [
    \"string\"
  ]
}"

GET/dashboards/users/widgets

Auth required

Read widget overrides for a user

Returns the widgets inherited and explicitly configured for the requested user within the current scope.

Parameters

Name	In	Required	Schema	Description
userId	query	Yes	any	—
tenantId	query	No	any	—
organizationId	query	No	any	—

Responses

200Widget settings for the user.

Content-Type: application/json

{
  "mode": "inherit",
  "widgetIds": [
    "string"
  ],
  "hasCustom": true,
  "effectiveWidgetIds": [
    "string"
  ],
  "scope": {
    "tenantId": null,
    "organizationId": null
  }
}

400Missing user identifier

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Insufficient permissions to manage user widgets

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/dashboards/users/widgets?userId=00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/dashboards/users/widgets

Auth required

Update user-specific dashboard widgets

Sets the widget override mode and allowed widgets for a user. Passing `mode: inherit` clears overrides.

Request body (application/json)

{
  "userId": "00000000-0000-4000-8000-000000000000",
  "mode": "inherit",
  "widgetIds": [
    "string"
  ]
}

Responses

200Overrides saved.

Content-Type: application/json

{
  "ok": true,
  "mode": "inherit",
  "widgetIds": [
    "string"
  ]
}

400Invalid payload or unknown widgets

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Insufficient permissions to manage user widgets

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/dashboards/users/widgets" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"userId\": \"00000000-0000-4000-8000-000000000000\",
  \"mode\": \"inherit\",
  \"widgetIds\": [
    \"string\"
  ]
}"

GET/dashboards/widgets/catalog

Auth required

List available dashboard widgets

Returns the catalog of widgets that modules expose, including defaults and feature requirements.

Responses

200Widgets available for assignment.

Content-Type: application/json

{
  "items": [
    {
      "id": "string",
      "title": "string",
      "description": null,
      "defaultSize": "sm",
      "defaultEnabled": true,
      "defaultSettings": null,
      "features": [
        "string"
      ],
      "moduleId": "string",
      "icon": null,
      "loaderKey": "string",
      "supportsRefresh": true
    }
  ]
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Insufficient permissions to view widget catalog

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/dashboards/widgets/catalog" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/dashboards/widgets/data

Auth required

Fetch aggregated data for dashboard widgets

Executes an aggregation query against the specified entity type and returns the result. Supports date range filtering, grouping, and period-over-period comparison.

Request body (application/json)

{
  "entityType": "string",
  "metric": {
    "field": "string",
    "aggregate": "count"
  }
}

Responses

200Aggregated data for the widget.

Content-Type: application/json

{
  "value": null,
  "data": [
    {
      "value": null
    }
  ],
  "metadata": {
    "fetchedAt": "string",
    "recordCount": 1,
    "currency": null
  }
}

400Invalid request payload

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Missing analytics.view feature

Content-Type: application/json

{
  "error": "string"
}

422Too many rows to group an encrypted field in application code

Content-Type: application/json

{
  "error": "string"
}

500Internal server error

Content-Type: application/json

{
  "error": "string"
}

503Encryption is configured but the group source cannot currently be resolved

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/dashboards/widgets/data" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityType\": \"string\",
  \"metric\": {
    \"field\": \"string\",
    \"aggregate\": \"count\"
  }
}"

POST/dashboards/widgets/data/batch

Auth required

Fetch aggregated data for multiple dashboard widgets in one request

Resolves a batch of widget data requests with a single authentication, RBAC, organization-scope, and database-context setup. Each request is keyed by an opaque widget id and resolved independently, so a failure in one widget does not fail the batch.

Request body (application/json)

{
  "requests": [
    {
      "id": "string",
      "request": {
        "entityType": "string",
        "metric": {
          "field": "string",
          "aggregate": "count"
        }
      }
    }
  ]
}

Responses

200Per-widget aggregation results keyed by request id.

Content-Type: application/json

{
  "results": [
    {
      "id": "string",
      "ok": true,
      "data": {
        "value": null,
        "data": [
          {
            "value": null
          }
        ],
        "metadata": {
          "fetchedAt": "string",
          "recordCount": 1,
          "currency": null
        }
      }
    }
  ]
}

400Invalid request payload

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

500Internal server error

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/dashboards/widgets/data/batch" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"requests\": [
    {
      \"id\": \"string\",
      \"request\": {
        \"entityType\": \"string\",
        \"metric\": {
          \"field\": \"string\",
          \"aggregate\": \"count\"
        }
      }
    }
  ]
}"

Dictionaries

Showing 11 of 11 endpoints

GET/dictionaries

Auth required

List dictionaries

Returns dictionaries accessible to the current organization, optionally including inactive records.

Parameters

Name	In	Required	Schema	Description
includeInactive	query	No	any	—

Responses

200Dictionary collection.

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "key": "string",
      "name": "string",
      "description": null,
      "isSystem": true,
      "isActive": true,
      "managerVisibility": null,
      "organizationId": null,
      "createdAt": "string",
      "updatedAt": null
    }
  ]
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

500Failed to load dictionaries

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/dictionaries" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/dictionaries

Auth required

Create dictionary

Registers a dictionary scoped to the current organization.

Request body (application/json)

{
  "key": "string",
  "name": "string"
}

Responses

201Dictionary created.

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "key": "string",
  "name": "string",
  "description": null,
  "isSystem": true,
  "isActive": true,
  "managerVisibility": null,
  "organizationId": null,
  "createdAt": "string",
  "updatedAt": null
}

400Validation failed

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

409Dictionary key already exists

Content-Type: application/json

{
  "error": "string"
}

500Failed to create dictionary

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/dictionaries" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"key\": \"string\",
  \"name\": \"string\"
}"

GET/dictionaries/{dictionaryId}

Auth required

Get dictionary

Returns details for the specified dictionary, including inheritance flags.

Parameters

Name	In	Required	Schema	Description
dictionaryId	path	Yes	any	—

Responses

200Dictionary details.

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "key": "string",
  "name": "string",
  "description": null,
  "isSystem": true,
  "isActive": true,
  "managerVisibility": null,
  "organizationId": null,
  "createdAt": "string",
  "updatedAt": null
}

400Invalid parameters

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

404Dictionary not found

Content-Type: application/json

{
  "error": "string"
}

500Failed to load dictionary

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/dictionaries/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PATCH/dictionaries/{dictionaryId}

Auth required

Update dictionary

Updates mutable attributes of the dictionary. Currency dictionaries are protected from modification.

Parameters

Name	In	Required	Schema	Description
dictionaryId	path	Yes	any	—

Request body (application/json)

{}

Responses

200Dictionary updated.

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "key": "string",
  "name": "string",
  "description": null,
  "isSystem": true,
  "isActive": true,
  "managerVisibility": null,
  "organizationId": null,
  "createdAt": "string",
  "updatedAt": null
}

400Validation failed or protected dictionary

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

404Dictionary not found

Content-Type: application/json

{
  "error": "string"
}

409Dictionary key already exists

Content-Type: application/json

{
  "error": "string"
}

500Failed to update dictionary

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PATCH "https://hr.office.dac.systems/api/dictionaries/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{}"

DELETE/dictionaries/{dictionaryId}

Auth required

Delete dictionary

Soft deletes the dictionary unless it is the protected currency dictionary.

Parameters

Name	In	Required	Schema	Description
dictionaryId	path	Yes	any	—

Responses

200Dictionary archived.

Content-Type: application/json

{
  "ok": true
}

400Protected dictionary cannot be deleted

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

404Dictionary not found

Content-Type: application/json

{
  "error": "string"
}

500Failed to delete dictionary

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/dictionaries/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/dictionaries/{dictionaryId}/entries

Auth required

List dictionary entries

Returns entries for the specified dictionary ordered by its configured entry sort mode. The number of entries returned per request is capped at 500; use `limit` and `offset` with the `total`/`hasMore` response fields to page through larger dictionaries.

Parameters

Name	In	Required	Schema	Description
dictionaryId	path	Yes	any	—
limit	query	No	any	Maximum entries to return. Defaults to and is capped at 500.
offset	query	No	any	Number of entries to skip. Defaults to 0.

Responses

200Dictionary entries.

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "value": "string",
      "label": "string",
      "color": null,
      "icon": null,
      "position": 1,
      "isDefault": true,
      "createdAt": "string",
      "updatedAt": null
    }
  ],
  "total": 1,
  "limit": 1,
  "offset": 1,
  "hasMore": true,
  "sortMode": "label_asc"
}

400Invalid parameters

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

404Dictionary not found

Content-Type: application/json

{
  "error": "string"
}

500Failed to load dictionary entries

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/dictionaries/00000000-0000-4000-8000-000000000000/entries" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/dictionaries/{dictionaryId}/entries

Auth required

Create dictionary entry

Creates a new entry in the specified dictionary.

Parameters

Name	In	Required	Schema	Description
dictionaryId	path	Yes	any	—

Request body (application/json)

{
  "value": "string",
  "color": null,
  "icon": null
}

Responses

201Dictionary entry created.

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "value": "string",
  "label": "string",
  "color": null,
  "icon": null,
  "position": 1,
  "isDefault": true,
  "createdAt": "string",
  "updatedAt": null
}

400Validation failed

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

404Dictionary not found

Content-Type: application/json

{
  "error": "string"
}

500Failed to create dictionary entry

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/dictionaries/00000000-0000-4000-8000-000000000000/entries" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"value\": \"string\",
  \"color\": null,
  \"icon\": null
}"

PATCH/dictionaries/{dictionaryId}/entries/{entryId}

Auth required

Update dictionary entry

Updates the specified dictionary entry using the command bus pipeline.

Parameters

Name	In	Required	Schema	Description
dictionaryId	path	Yes	any	—
entryId	path	Yes	any	—

Request body (application/json)

{
  "color": null,
  "icon": null
}

Responses

200Dictionary entry updated.

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "value": "string",
  "label": "string",
  "color": null,
  "icon": null,
  "position": 1,
  "isDefault": true,
  "createdAt": "string",
  "updatedAt": null
}

400Validation failed

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

404Dictionary or entry not found

Content-Type: application/json

{
  "error": "string"
}

500Failed to update entry

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PATCH "https://hr.office.dac.systems/api/dictionaries/00000000-0000-4000-8000-000000000000/entries/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"color\": null,
  \"icon\": null
}"

DELETE/dictionaries/{dictionaryId}/entries/{entryId}

Auth required

Delete dictionary entry

Deletes the specified dictionary entry via the command bus.

Parameters

Name	In	Required	Schema	Description
dictionaryId	path	Yes	any	—
entryId	path	Yes	any	—

Responses

200Entry deleted.

Content-Type: application/json

{
  "ok": true
}

400Validation failed

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

404Dictionary or entry not found

Content-Type: application/json

{
  "error": "string"
}

500Failed to delete entry

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/dictionaries/00000000-0000-4000-8000-000000000000/entries/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/dictionaries/{dictionaryId}/entries/reorder

Auth required

Reorder dictionary entries

Updates the position of dictionary entries for drag-and-drop reordering.

Parameters

Name	In	Required	Schema	Description
dictionaryId	path	Yes	any	—

Request body (application/json)

{
  "entries": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "position": 1
    }
  ]
}

Responses

200Entries reordered.

Content-Type: application/json

{
  "ok": true
}

400Validation failed

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

404Dictionary not found

Content-Type: application/json

{
  "error": "string"
}

500Failed to reorder entries

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/dictionaries/00000000-0000-4000-8000-000000000000/entries/reorder" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entries\": [
    {
      \"id\": \"00000000-0000-4000-8000-000000000000\",
      \"position\": 1
    }
  ]
}"

POST/dictionaries/{dictionaryId}/entries/set-default

Auth required

Set default dictionary entry

Marks the specified entry as the default for this dictionary, clearing any previous default.

Parameters

Name	In	Required	Schema	Description
dictionaryId	path	Yes	any	—

Request body (application/json)

{
  "entryId": "00000000-0000-4000-8000-000000000000"
}

Responses

200Default entry set.

Content-Type: application/json

{
  "ok": true
}

400Validation failed

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

404Dictionary or entry not found

Content-Type: application/json

{
  "error": "string"
}

500Failed to set default entry

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/dictionaries/00000000-0000-4000-8000-000000000000/entries/set-default" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entryId\": \"00000000-0000-4000-8000-000000000000\"
}"

Entities

Showing 19 of 19 endpoints

GET/entities/definitions

Auth required

List active custom field definitions

Returns active custom field definitions for the supplied entity ids, respecting tenant scope and tombstones.

Parameters

Name	In	Required	Schema	Description
entityId	query	No	any	—
entityIds	query	No	any	—
fieldset	query	No	any	—

Responses

200Definition list

Content-Type: application/json

{
  "items": [
    {
      "key": "string",
      "kind": "string",
      "label": "string",
      "entityId": "string"
    }
  ]
}

400Missing entity id

Content-Type: application/json

{
  "error": "string"
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/entities/definitions" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/entities/definitions

Auth required

Upsert custom field definition

Creates or updates a custom field definition for the current tenant/org scope.

Request body (application/json)

{
  "entityId": "string",
  "key": "string",
  "kind": "text"
}

Responses

200Definition saved

Content-Type: application/json

{
  "ok": true,
  "item": {
    "id": "00000000-0000-4000-8000-000000000000",
    "key": "string",
    "kind": "string",
    "configJson": {}
  }
}

400Validation failed

Content-Type: application/json

{
  "error": "string"
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/entities/definitions" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityId\": \"string\",
  \"key\": \"string\",
  \"kind\": \"text\"
}"

DELETE/entities/definitions

Auth required

Soft delete custom field definition

Marks the specified definition inactive and tombstones it for the current scope.

Request body (application/json)

{
  "entityId": "string",
  "key": "string"
}

Responses

200Definition deleted

Content-Type: application/json

{
  "ok": true,
  "version": null
}

400Missing entity id or key

Content-Type: application/json

{
  "error": "string"
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

404Definition not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/entities/definitions" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityId\": \"string\",
  \"key\": \"string\"
}"

POST/entities/definitions.batch

Auth required

Save multiple custom field definitions

Creates or updates multiple definitions for a single entity in one transaction.

Request body (application/json)

{
  "entityId": "string",
  "definitions": [
    {
      "key": "string",
      "kind": "text"
    }
  ]
}

Responses

200Definitions saved

Content-Type: application/json

{
  "ok": true,
  "version": null
}

400Validation error

Content-Type: application/json

{
  "error": "string"
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

500Unexpected failure

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/entities/definitions.batch" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityId\": \"string\",
  \"definitions\": [
    {
      \"key\": \"string\",
      \"kind\": \"text\"
    }
  ]
}"

GET/entities/definitions.manage

Auth required

Get management snapshot

Returns scoped custom field definitions (including inactive tombstones) for administration interfaces.

Parameters

Name	In	Required	Schema	Description
entityId	query	Yes	any	—

Responses

200Scoped definitions and deleted keys

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "key": "string",
      "kind": "string",
      "configJson": null,
      "organizationId": null,
      "tenantId": null
    }
  ],
  "deletedKeys": [
    "string"
  ],
  "version": null
}

400Missing entity id

Content-Type: application/json

{
  "error": "string"
}

401Missing authentication or feature

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/entities/definitions.manage?entityId=string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/entities/definitions.restore

Auth required

Restore definition

Reactivates a previously soft-deleted definition within the current tenant/org scope.

Request body (application/json)

{
  "entityId": "string",
  "key": "string"
}

Responses

200Definition restored

Content-Type: application/json

{
  "ok": true
}

400Missing entity id or key

Content-Type: application/json

{
  "error": "string"
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

404Definition not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/entities/definitions.restore" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityId\": \"string\",
  \"key\": \"string\"
}"

GET/entities/encryption

Auth required

Fetch encryption map

Returns the encrypted field map for the current tenant/organization scope.

Parameters

Name	In	Required	Schema	Description
entityId	query	Yes	any	—

Responses

200Map

Content-Type: application/json

{
  "entityId": "string",
  "fields": [
    {
      "field": "string",
      "hashField": null
    }
  ],
  "updatedAt": null
}

Example

curl -X GET "https://hr.office.dac.systems/api/entities/encryption?entityId=string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/entities/encryption

Auth required

Upsert encryption map

Creates or updates the encryption map for the current tenant/organization scope. Enforces optimistic locking when the caller sends the expected version header.

Request body (application/json)

{
  "entityId": "string",
  "tenantId": null,
  "organizationId": null,
  "fields": [
    {
      "field": "string",
      "hashField": null
    }
  ]
}

Responses

200Saved

Content-Type: application/json

{
  "ok": true,
  "updatedAt": null
}

409Optimistic-lock conflict (stale write)

Content-Type: application/json

{
  "error": "string",
  "code": "string",
  "currentUpdatedAt": "string",
  "expectedUpdatedAt": "string"
}

422Selected organization is unavailable

Content-Type: application/json

{
  "error": "string",
  "code": "organization_selection_invalid"
}

Example

curl -X POST "https://hr.office.dac.systems/api/entities/encryption" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityId\": \"string\",
  \"tenantId\": null,
  \"organizationId\": null,
  \"fields\": [
    {
      \"field\": \"string\",
      \"hashField\": null
    }
  ]
}"

GET/entities/entities

Auth required

List available entities

Returns generated and custom entities scoped to the caller with field counts per entity.

Responses

200List of entities

Content-Type: application/json

{
  "items": [
    {
      "entityId": "string",
      "source": "code",
      "label": "string",
      "count": 1
    }
  ]
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/entities/entities" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/entities/entities

Auth required

Upsert custom entity

Creates or updates a tenant/org scoped custom entity definition.

Request body (application/json)

{
  "entityId": "string",
  "label": "string",
  "description": null,
  "showInSidebar": false,
  "accessRestricted": false
}

Responses

200Entity saved

Content-Type: application/json

{
  "ok": true,
  "item": {
    "id": "00000000-0000-4000-8000-000000000000",
    "entityId": "string",
    "label": "string"
  }
}

400Validation error

Content-Type: application/json

{
  "error": "string"
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/entities/entities" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityId\": \"string\",
  \"label\": \"string\",
  \"description\": null,
  \"showInSidebar\": false,
  \"accessRestricted\": false
}"

DELETE/entities/entities

Auth required

Soft delete custom entity

Marks the specified custom entity inactive within the current scope.

Request body (application/json)

{
  "entityId": "string"
}

Responses

200Entity deleted

Content-Type: application/json

{
  "ok": true
}

400Missing entity id

Content-Type: application/json

{
  "error": "string"
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

404Entity not found in scope

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/entities/entities" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityId\": \"string\"
}"

GET/entities/entity-settings

Auth required

Get custom entity settings

Returns the tenant-scoped default-restricted policy for new custom entities.

Responses

200Current settings

Content-Type: application/json

{
  "newEntitiesRestrictedByDefault": true,
  "updatedAt": null
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/entities/entity-settings" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/entities/entity-settings

Auth required

Update custom entity settings

Sets the tenant-scoped default-restricted policy for new custom entities.

Request body (application/json)

{
  "newEntitiesRestrictedByDefault": true
}

Responses

200Updated settings

Content-Type: application/json

{
  "ok": true,
  "newEntitiesRestrictedByDefault": true,
  "updatedAt": null
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

409Optimistic lock conflict

Content-Type: application/json

{
  "code": "string",
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/entities/entity-settings" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"newEntitiesRestrictedByDefault\": true
}"

GET/entities/records

Auth required

List records

Returns paginated records for the supplied entity. Supports custom field filters, exports, and soft-delete toggles.

Parameters

Name	In	Required	Schema	Description
entityId	query	Yes	any	—
page	query	No	any	—
pageSize	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—
search	query	No	any	—
searchFields	query	No	any	—
withDeleted	query	No	any	—
format	query	No	any	—
exportScope	query	No	any	—
export_scope	query	No	any	—
all	query	No	any	—
full	query	No	any	—

Responses

200Paginated records

Content-Type: application/json

{
  "items": [
    {}
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1,
  "totalPages": 1
}

400Missing entity id

Content-Type: application/json

{
  "error": "string"
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

500Unexpected failure

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/entities/records?entityId=string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/entities/records

Auth required

Create record

Creates a record for the given entity. When `recordId` is omitted or not a UUID the data engine will generate one automatically.

Request body (application/json)

{
  "entityId": "string",
  "values": {}
}

Responses

200Record created

Content-Type: application/json

{
  "ok": true
}

400Validation failure

Content-Type: application/json

{
  "error": "string"
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

500Unexpected failure

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/entities/records" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityId\": \"string\",
  \"values\": {}
}"

PUT/entities/records

Auth required

Update record

Updates an existing record. If the provided recordId is not a UUID the record will be created instead to support optimistic flows.

Request body (application/json)

{
  "entityId": "string",
  "recordId": "string",
  "values": {}
}

Responses

200Record updated

Content-Type: application/json

{
  "ok": true
}

400Validation failure

Content-Type: application/json

{
  "error": "string"
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

500Unexpected failure

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/entities/records" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityId\": \"string\",
  \"recordId\": \"string\",
  \"values\": {}
}"

DELETE/entities/records

Auth required

Delete record

Soft deletes the specified record within the current tenant/org scope.

Request body (application/json)

{
  "entityId": "string",
  "recordId": "string"
}

Responses

200Record deleted

Content-Type: application/json

{
  "ok": true
}

400Missing entity id or record id

Content-Type: application/json

{
  "error": "string"
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

404Record not found

Content-Type: application/json

{
  "error": "string"
}

500Unexpected failure

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/entities/records" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityId\": \"string\",
  \"recordId\": \"string\"
}"

GET/entities/relations/options

Auth required

List relation options

Returns up to 200 option entries for populating relation dropdowns, automatically resolving label fields when omitted. An entityId that matches neither an active custom entity nor a registered ORM entity yields an empty option list.

Parameters

Name	In	Required	Schema	Description
entityId	query	Yes	any	—
labelField	query	No	any	—
q	query	No	any	—
ids	query	No	any	—
routeContextFields	query	No	any	—

Responses

200Option list

Content-Type: application/json

{
  "items": [
    {
      "value": "string",
      "label": "string"
    }
  ]
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/entities/relations/options?entityId=string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/entities/sidebar-entities

Auth required

Get sidebar entities

Returns custom entities flagged with `showInSidebar` for the current tenant/org scope.

Responses

200Sidebar entities for navigation

Content-Type: application/json

{
  "items": [
    {
      "entityId": "string",
      "label": "string",
      "href": "string"
    }
  ]
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/entities/sidebar-entities" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Forms Admin

Showing 7 of 7 endpoints

GET/forms/{id}/analytics

Auth required

Aggregate analytics for a form

Tenant-scoped, PII-safe aggregate analytics across all versions of a form: funnel/completion, daily volume, time-to-complete, per-field response counts (value distributions only for non-sensitive enumerable types), and best-effort draft drop-off. Counts only — never raw answer values.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Aggregate analytics

Content-Type: application/json

{
  "formId": "string",
  "window": {
    "from": null,
    "to": null
  },
  "scan": {
    "limit": 1,
    "scanned": 1,
    "capped": true
  },
  "funnel": {
    "started": 1,
    "submitted": 1,
    "completionRate": 1,
    "byStatus": {
      "key": 1
    }
  },
  "volume": [
    {
      "date": "string",
      "started": 1,
      "submitted": 1
    }
  ],
  "timeToComplete": {
    "sampleSize": 1,
    "medianSeconds": null,
    "averageSeconds": null
  },
  "fields": [
    {
      "fieldKey": "string",
      "type": "string",
      "sensitive": true,
      "answered": 1,
      "blank": 1
    }
  ],
  "dropOff": [
    {
      "sectionKey": "string",
      "count": 1
    }
  ]
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

403Tenant scope required

Content-Type: application/json

{
  "error": "string"
}

422Bad query parameters

Content-Type: application/json

{
  "error": "string"
}

500Computation failed

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/:id/analytics" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/forms/{id}/submissions

Auth required

List submissions for a form (admin inbox)

Paginated submission listing scoped to the form id.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Submission list

Content-Type: application/json

{
  "items": [
    {}
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

422Bad query parameters

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/:id/submissions" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/forms/submissions/{submissionId}

Auth required

Get a submission for the admin inbox

Returns the current submission state for the admin role. Phase 2b will write a form_access_audit row at this call site.

Parameters

Name	In	Required	Schema	Description
submissionId	path	Yes	any	—

Responses

200Submission state

Content-Type: application/json

{
  "submission": {},
  "revision": {},
  "decoded_data": {},
  "actors": [
    {}
  ],
  "formVersion": {}
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

404Submission not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/submissions/:submissionId" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/forms/submissions/{submissionId}/actors

Auth required

Assign an actor to a submission

Assigns a (user, role) pair as an active actor on the submission. The role MUST be declared on the form version.

Parameters

Name	In	Required	Schema	Description
submissionId	path	Yes	any	—

Request body (application/json)

{
  "user_id": "00000000-0000-4000-8000-000000000000",
  "role": "string"
}

Responses

201Actor assigned

Content-Type: application/json

{
  "actor": {}
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

404Submission not found

Content-Type: application/json

{
  "error": "string"
}

422Invalid role for the form version

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/submissions/:submissionId/actors" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"user_id\": \"00000000-0000-4000-8000-000000000000\",
  \"role\": \"string\"
}"

DELETE/forms/submissions/{submissionId}/actors/{actorId}

Auth required

Revoke a submission actor

Revokes the supplied actor row by setting revoked_at.

Parameters

Name	In	Required	Schema	Description
submissionId	path	Yes	any	—
actorId	path	Yes	any	—

Responses

200Actor revoked

Content-Type: application/json

{
  "ok": true
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

404Actor not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/forms/submissions/:submissionId/actors/:actorId" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/forms/submissions/{submissionId}/reopen

Auth required

Reopen a submitted submission

Transitions status from submitted back to reopened so further saves are allowed.

Parameters

Name	In	Required	Schema	Description
submissionId	path	Yes	any	—

Responses

200Submission reopened

Content-Type: application/json

{
  "submission": {}
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

404Submission not found

Content-Type: application/json

{
  "error": "string"
}

422Submission not in submitted state

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/submissions/:submissionId/reopen" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/forms/submissions/{submissionId}/revisions

Auth required

List submission revisions

Returns the append-only revision timeline for an admin viewer.

Parameters

Name	In	Required	Schema	Description
submissionId	path	Yes	any	—

Responses

200Revisions

Content-Type: application/json

{
  "submission": {},
  "revisions": [
    {}
  ]
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

404Submission not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/submissions/:submissionId/revisions" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Forms Runtime

Showing 10 of 10 endpoints

GET/forms/{id}/run/context

Auth required

Get the published form version for the in-app runner.

Returns the schema + uiSchema for the form's currently published version. Authenticated and scoped to the caller's tenant and organization — anonymous runs go through POST /api/forms/public/start instead.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Published form version

Content-Type: application/json

{
  "form": {
    "id": "00000000-0000-4000-8000-000000000000",
    "key": "string",
    "name": "string",
    "defaultLocale": "string",
    "supportedLocales": [
      "string"
    ]
  },
  "formVersion": {
    "id": "00000000-0000-4000-8000-000000000000",
    "versionNumber": 1,
    "schemaHash": "string",
    "registryVersion": "string"
  },
  "schema": {},
  "uiSchema": {},
  "requiresCustomerAuth": true
}

400Missing tenant or organization context

Content-Type: application/json

{
  "error": "string"
}

401Unauthenticated

Content-Type: application/json

{
  "error": "string"
}

404Form or version not found

Content-Type: application/json

{
  "error": "string"
}

422Form not active or unpublished

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/:id/run/context" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/forms/{id}/run/submissions

Auth required

Submit answers via the in-app runner with tamper validation.

Server-side re-runs the evaluator against the posted answers and asserts the claimed ending is reachable. 422 on mismatch. Authenticated and scoped to the caller's tenant and organization; deprecated in favour of POST /api/forms/public/submissions/:id/submit.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Submission accepted (validation only — persistence in phase 1d).

Content-Type: application/json

{
  "accepted": true,
  "reachedEndingKey": null
}

400Malformed body, or missing tenant/organization context

Content-Type: application/json

{
  "error": "string"
}

401Unauthenticated

Content-Type: application/json

{
  "error": "string"
}

404Form or version not found

Content-Type: application/json

{
  "error": "string"
}

422Form inactive or tamper detected

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/:id/run/submissions" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/forms/by-key/{key}/active

Get active form version by key

Returns the published form version matching the supplied key, sliced to the caller's available roles.

Parameters

Name	In	Required	Schema	Description
key	path	Yes	any	—

Responses

200Active form version

Content-Type: application/json

{
  "form": {
    "id": "00000000-0000-4000-8000-000000000000",
    "key": "string",
    "name": "string",
    "defaultLocale": "string",
    "supportedLocales": [
      "string"
    ]
  },
  "formVersion": {
    "id": "00000000-0000-4000-8000-000000000000",
    "versionNumber": 1,
    "schemaHash": "string",
    "registryVersion": "string",
    "roles": [
      "string"
    ]
  },
  "schema": {},
  "uiSchema": {},
  "fieldIndex": {
    "key": {
      "key": "string",
      "type": "string",
      "sectionKey": null,
      "sensitive": true,
      "editableBy": [
        "string"
      ],
      "visibleTo": [
        "string"
      ],
      "required": true
    }
  },
  "callerRoles": [
    "string"
  ]
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

404Form not found

Content-Type: application/json

{
  "error": "string"
}

422Form is not active or has no published version

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/by-key/:key/active" \
  -H "Accept: application/json"

POST/forms/form-submissions

Start a new form submission

Starts a submission for the active version of a form, auto-assigning the starter to the default actor role.

Request body (application/json)

{
  "form_key": "string",
  "subject_type": "string",
  "subject_id": "00000000-0000-4000-8000-000000000000"
}

Responses

201Submission started

Content-Type: application/json

{
  "submission": {},
  "revision": {},
  "decoded_data": {},
  "actors": [
    {}
  ]
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

404Form not found

Content-Type: application/json

{
  "error": "string"
}

422Validation or form-state error

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/form-submissions" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "{
  \"form_key\": \"string\",
  \"subject_type\": \"string\",
  \"subject_id\": \"00000000-0000-4000-8000-000000000000\"
}"

GET/forms/form-submissions/{id}

Get current submission state (role-sliced)

Returns the current revision payload sliced to the calling user's active actor role.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Submission state

Content-Type: application/json

{
  "submission": {},
  "revision": {},
  "decoded_data": {},
  "actors": [
    {}
  ]
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

404Submission not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/form-submissions/:id" \
  -H "Accept: application/json"

PATCH/forms/form-submissions/{id}

Save (autosave) a submission revision

Appends a revision when the supplied base_revision_id matches; rate-limited to FORMS_AUTOSAVE_INTERVAL_MS / 2.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "base_revision_id": "00000000-0000-4000-8000-000000000000",
  "patch": {}
}

Responses

200Revision saved

Content-Type: application/json

{
  "revision": {},
  "coalesced": true
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

403No active actor row for user

Content-Type: application/json

{
  "error": "string"
}

404Submission not found

Content-Type: application/json

{
  "error": "string"
}

409Stale base_revision_id

Content-Type: application/json

{
  "error": "string"
}

422Validation failed

Content-Type: application/json

{
  "error": "string"
}

429Save rate limit exceeded

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PATCH "https://hr.office.dac.systems/api/forms/form-submissions/:id" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "{
  \"base_revision_id\": \"00000000-0000-4000-8000-000000000000\",
  \"patch\": {}
}"

POST/forms/form-submissions/{id}/attachments

Upload an attachment (authenticated)

Stores an encrypted file for a file-typed field. Caller must be an active actor on the submission.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

201Attachment stored

Content-Type: application/json

{
  "id": "string",
  "filename": "string",
  "contentType": "string",
  "sizeBytes": 1
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

403No active actor row for user

Content-Type: application/json

{
  "error": "string"
}

413File empty or oversize

Content-Type: application/json

{
  "error": "string"
}

422Disallowed type / invalid field / scan rejected

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/form-submissions/:id/attachments" \
  -H "Accept: application/json"

GET/forms/form-submissions/{id}/resume-token

Issue a resume token for a submission

Returns a signed token that another device can use to resume the submission. TTL governed by FORMS_RESUME_TOKEN_TTL_S.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Resume token issued

Content-Type: application/json

{
  "token": "string",
  "expiresAt": "string"
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

403No active actor row for user

Content-Type: application/json

{
  "error": "string"
}

404Submission not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/form-submissions/:id/resume-token" \
  -H "Accept: application/json"

POST/forms/form-submissions/{id}/submit

Submit a form submission

Final submission of a draft submission. Verifies base_revision_id and stores the submit metadata.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "base_revision_id": "00000000-0000-4000-8000-000000000000"
}

Responses

200Submission submitted

Content-Type: application/json

{
  "submission": {}
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

404Submission not found

Content-Type: application/json

{
  "error": "string"
}

409Stale base_revision_id

Content-Type: application/json

{
  "error": "string"
}

422Submission already in terminal state

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/form-submissions/:id/submit" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "{
  \"base_revision_id\": \"00000000-0000-4000-8000-000000000000\"
}"

GET/forms/form-submissions/by-subject/{subject_type}/{subject_id}

List submissions for a subject

Returns submissions accessible to the caller for the supplied (subject_type, subject_id).

Parameters

Name	In	Required	Schema	Description
subject_type	path	Yes	any	—
subject_id	path	Yes	any	—

Responses

200Submission list

Content-Type: application/json

{
  "items": [
    {}
  ]
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

422Bad subject identifier

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/form-submissions/by-subject/:subject_type/:subject_id" \
  -H "Accept: application/json"

Forms Authoring

Showing 1 of 1 endpoints

POST/forms/{id}/theme-logo

Auth required

Upload a form logo/header image

Stores a brand logo as a public, unscoped attachment and returns its assetId for x-om-theme.logo. Requires forms.design.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

201Logo stored

Content-Type: application/json

{
  "assetId": "00000000-0000-4000-8000-000000000000"
}

400Not a multipart upload

Content-Type: application/json

{
  "error": "string"
}

404Form not found in scope

Content-Type: application/json

{
  "error": "string"
}

413File too large

Content-Type: application/json

{
  "error": "string"
}

422Missing file or not a valid image

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/:id/theme-logo" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Forms Public Runtime

Showing 11 of 11 endpoints

GET/forms/public/distributions/{slug}

Resolve an open-link distribution

Returns the form context served by an open-mode distribution identified by its public slug.

Parameters

Name	In	Required	Schema	Description
slug	path	Yes	any	—

Responses

200Distribution form context

Content-Type: application/json

{
  "distribution_id": "00000000-0000-4000-8000-000000000000",
  "form": {
    "key": "string",
    "name": "string",
    "defaultLocale": "string",
    "supportedLocales": [
      "string"
    ]
  },
  "schema": {},
  "ui_schema": {},
  "fieldIndex": {},
  "completion": {
    "title": null,
    "message": null
  },
  "redirect_url": null,
  "embed": null,
  "requires_customer_auth": true,
  "default_locale": "string"
}

404Distribution or form not found

Content-Type: application/json

{
  "error": "string"
}

410Distribution closed, not yet open, or response cap reached

Content-Type: application/json

{
  "error": "string"
}

429Rate limit exceeded

Content-Type: application/json

{
  "error": "string"
}

503Rate limiting unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/public/distributions/:slug" \
  -H "Accept: application/json"

GET/forms/public/distributions/{slug}/embed-policy

Resolve the embed framing policy for a distribution

Returns the Content-Security-Policy frame-ancestors directive authorizing which origins may frame the /embed/:slug host page. Fails closed to frame-ancestors none for non-embeddable or unknown distributions.

Parameters

Name	In	Required	Schema	Description
slug	path	Yes	any	—

Responses

200Embed framing policy

Content-Type: application/json

{
  "frame_ancestors": "string",
  "embeddable": true
}

429Rate limit exceeded

Content-Type: application/json

"string"

503Rate limiting unavailable

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/forms/public/distributions/:slug/embed-policy" \
  -H "Accept: application/json"

GET/forms/public/embed-loader

Serve the external embed loader script

Returns a framework-free JS loader that injects an iframe per [data-om-form] element pointing at /embed/:slug and wires postMessage auto-resize.

Responses

200The embed loader script (application/javascript)

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/forms/public/embed-loader" \
  -H "Accept: application/json"

GET/forms/public/invitations/{token}

Resolve a personal invitation

Returns the form context for a personal-mode invitation identified by its raw token, marking the invitation opened.

Parameters

Name	In	Required	Schema	Description
token	path	Yes	any	—

Responses

200Invitation form context

Content-Type: application/json

{
  "distribution_id": "00000000-0000-4000-8000-000000000000",
  "form": {
    "key": "string",
    "name": "string",
    "defaultLocale": "string",
    "supportedLocales": [
      "string"
    ]
  },
  "schema": {},
  "ui_schema": {},
  "fieldIndex": {},
  "completion": {
    "title": null,
    "message": null
  },
  "redirect_url": null,
  "requires_customer_auth": true,
  "default_locale": "string",
  "invitation": {
    "id": "00000000-0000-4000-8000-000000000000",
    "status": "string",
    "locale": null
  }
}

404Invitation, distribution, or form not found

Content-Type: application/json

{
  "error": "string"
}

410Invitation submitted, expired, or revoked; distribution unavailable

Content-Type: application/json

{
  "error": "string"
}

429Rate limit exceeded

Content-Type: application/json

{
  "error": "string"
}

503Rate limiting unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/public/invitations/:token" \
  -H "Accept: application/json"

POST/forms/public/start

Begin an anonymous submission

Resolves a distribution by slug or token and bootstraps an anonymous submission, returning a submission access token.

Request body (application/json)

{}

Responses

201Submission started

Content-Type: application/json

{
  "submission": {},
  "revision": {},
  "decoded_data": {},
  "access_token": "string",
  "expires_at": "string"
}

404Distribution, invitation, or form not found

Content-Type: application/json

{
  "error": "string"
}

409Distribution requires customer authentication

Content-Type: application/json

{
  "error": "string"
}

410Distribution / invitation unavailable

Content-Type: application/json

{
  "error": "string"
}

422Validation failed, CAPTCHA required, or CAPTCHA verification failed

Content-Type: application/json

{
  "error": "string"
}

429Rate limit exceeded

Content-Type: application/json

{
  "error": "string"
}

503CAPTCHA or rate limiting is unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/public/start" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "{}"

GET/forms/public/submissions/{id}

Resume a public submission

Returns the role-sliced current state for the submission named in the access token (or customer session).

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Submission state

Content-Type: application/json

{
  "submission": {},
  "revision": {},
  "decoded_data": {},
  "actors": [
    {}
  ]
}

401Missing or invalid access token / session

Content-Type: application/json

{
  "error": "string"
}

404Submission not found

Content-Type: application/json

{
  "error": "string"
}

429Rate limit exceeded

Content-Type: application/json

{
  "error": "string"
}

503Rate limiting unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/public/submissions/:id" \
  -H "Accept: application/json"

PATCH/forms/public/submissions/{id}

Autosave a public submission

Appends a revision when base_revision_id matches; re-issues the access token (token-authorized requests) with a slid TTL.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "base_revision_id": "00000000-0000-4000-8000-000000000000",
  "patch": {}
}

Responses

200Revision saved

Content-Type: application/json

{
  "revision": {}
}

401Missing or invalid access token / session

Content-Type: application/json

{
  "error": "string"
}

404Submission not found

Content-Type: application/json

{
  "error": "string"
}

409Stale base_revision_id

Content-Type: application/json

{
  "error": "string"
}

422Validation failed

Content-Type: application/json

{
  "error": "string"
}

429Rate limit exceeded

Content-Type: application/json

{
  "error": "string"
}

503Rate limiting unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PATCH "https://hr.office.dac.systems/api/forms/public/submissions/:id" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "{
  \"base_revision_id\": \"00000000-0000-4000-8000-000000000000\",
  \"patch\": {}
}"

POST/forms/public/submissions/{id}/attachments

Upload an attachment (public/anonymous)

Stores an encrypted file for a file-typed field. Authorized via access token or portal session.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

201Attachment stored

Content-Type: application/json

{
  "id": "string",
  "filename": "string",
  "contentType": "string",
  "sizeBytes": 1
}

401Missing or invalid access token / session

Content-Type: application/json

{
  "error": "string"
}

413File empty or oversize

Content-Type: application/json

{
  "error": "string"
}

422Disallowed type / invalid field / scan rejected

Content-Type: application/json

{
  "error": "string"
}

429Rate limit exceeded

Content-Type: application/json

{
  "error": "string"
}

503Rate limiting unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/public/submissions/:id/attachments" \
  -H "Accept: application/json"

GET/forms/public/submissions/{id}/attachments/{attachmentId}

Download a submission attachment (public/anonymous)

Streams the decrypted user-upload bytes for the owning participant. Authorized via access token or portal session.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—
attachmentId	path	Yes	any	—

Responses

200Attachment stream

Content-Type: application/octet-stream

string

401Missing or invalid access token / session

Content-Type: application/json

"string"

404Attachment not found

Content-Type: application/json

"string"

429Rate limit exceeded

Content-Type: application/json

"string"

503Rate limiting unavailable

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/forms/public/submissions/:id/attachments/:attachmentId" \
  -H "Accept: application/json"

GET/forms/public/submissions/{id}/pdf

Download a submission PDF snapshot (public/anonymous)

Streams the immutable signed-PDF snapshot for the owning participant. Authorized via access token or portal session. Generates the snapshot on first request when missing.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200PDF stream

Content-Type: application/pdf

string

401Missing or invalid access token / session

Content-Type: application/json

"string"

404Submission not found

Content-Type: application/json

"string"

409Submission not yet submitted

Content-Type: application/json

"string"

429Rate limit exceeded

Content-Type: application/json

"string"

503Rate limiting unavailable

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/forms/public/submissions/:id/pdf" \
  -H "Accept: application/json"

POST/forms/public/submissions/{id}/submit

Submit a public submission

Finalizes the submission named in the access token / session, enforcing the distribution response cap atomically before submitting.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "base_revision_id": "00000000-0000-4000-8000-000000000000"
}

Responses

200Submission submitted

Content-Type: application/json

{
  "submission": {},
  "redirect_url": null
}

401Missing or invalid access token / session

Content-Type: application/json

{
  "error": "string"
}

404Submission or invitation not found

Content-Type: application/json

{
  "error": "string"
}

409Stale base_revision_id

Content-Type: application/json

{
  "error": "string"
}

410Distribution response cap reached or unavailable

Content-Type: application/json

{
  "error": "string"
}

422Validation failed or submission in terminal state

Content-Type: application/json

{
  "error": "string"
}

429Rate limit exceeded

Content-Type: application/json

{
  "error": "string"
}

503Rate limiting unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/public/submissions/:id/submit" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "{
  \"base_revision_id\": \"00000000-0000-4000-8000-000000000000\"
}"

Forms Compliance

Showing 7 of 7 endpoints

GET/forms/subjects/{subjectType}/{subjectId}/consents

Auth required

List consent records for a data subject

Returns the subject's consent history projected from signed signature fields — active and superseded records. PII-free: clause SHA-256, signed-at, status timestamps, and ids only. Optional `status` and `formId` query filters. Requires `forms.view`.

Parameters

Name	In	Required	Schema	Description
subjectType	path	Yes	any	—
subjectId	path	Yes	any	—

Responses

200Consent records for the subject (newest signed first)

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "formId": "00000000-0000-4000-8000-000000000000",
      "formName": null,
      "formVersionId": "00000000-0000-4000-8000-000000000000",
      "versionNumber": 1,
      "submissionId": "00000000-0000-4000-8000-000000000000",
      "consentFieldKey": "string",
      "clauseSha256": "string",
      "signedAt": "string",
      "status": "string",
      "supersededAt": null,
      "supersededByRecordId": null
    }
  ]
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

403Tenant scope required

Content-Type: application/json

{
  "error": "string"
}

422Bad subject identifier or filter

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/subjects/:subjectType/:subjectId/consents" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/forms/subjects/{subjectType}/{subjectId}/export

Auth required

Export all submissions for a data subject (GDPR Art. 15/20)

Returns a structured JSON document with every submission for the subject — form key/name, version, status, timestamps, decrypted answers keyed by field with labels, and signature metadata. Attachments are referenced by id. Writes one `export` access-audit row per submission. Requires `forms.submissions.export`.

Parameters

Name	In	Required	Schema	Description
subjectType	path	Yes	any	—
subjectId	path	Yes	any	—

Responses

200Export document (downloaded as an attachment)

Content-Type: application/json

{}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

403Tenant scope required

Content-Type: application/json

{
  "error": "string"
}

422Bad subject identifier

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/subjects/:subjectType/:subjectId/export" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/forms/submissions/{submissionId}/access-audit

Auth required

List submission access-audit rows

Returns the access-audit trail for a submission (who/when/purpose/IP). Carries no payload content. Reading the list does not write a new audit row.

Parameters

Name	In	Required	Schema	Description
submissionId	path	Yes	any	—

Responses

200Access-audit rows

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "accessedBy": "00000000-0000-4000-8000-000000000000",
      "accessedAt": "string",
      "accessPurpose": "view",
      "ip": null,
      "revisionId": null
    }
  ]
}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

404Submission not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/submissions/:submissionId/access-audit" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/forms/submissions/{submissionId}/anonymize

Auth required

Anonymize a submission (irreversible)

Tombstones every sensitive field across every revision. Requires body `{ "confirm": "DELETE" }`. Preserves actor rows and access-audit rows. Emits `forms.submission.anonymized`.

Parameters

Name	In	Required	Schema	Description
submissionId	path	Yes	any	—

Request body (application/json)

{
  "confirm": "DELETE"
}

Responses

200Anonymization complete

Content-Type: application/json

{
  "submissionId": "00000000-0000-4000-8000-000000000000",
  "revisionsAnonymized": 1,
  "anonymizedAt": "string"
}

404Submission not found

Content-Type: application/json

{
  "error": "string"
}

422Missing typed confirmation or other validation failure

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/forms/submissions/:submissionId/anonymize" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"confirm\": \"DELETE\"
}"

GET/forms/submissions/{submissionId}/attachments/{attachmentId}

Auth required

Download a submission attachment (admin)

Streams the decrypted user-upload bytes. Writes an access-audit row with access_purpose = "export".

Parameters

Name	In	Required	Schema	Description
submissionId	path	Yes	any	—
attachmentId	path	Yes	any	—

Responses

200Attachment stream

Content-Type: application/octet-stream

string

401Not authenticated

Content-Type: application/json

"string"

403Tenant scope required

Content-Type: application/json

"string"

404Attachment not found

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/forms/submissions/:submissionId/attachments/:attachmentId" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/forms/submissions/{submissionId}/export

Auth required

Export a single submission (GDPR Art. 15/20)

Returns the structured export document for one submission — decrypted answers keyed by field with labels, signature metadata, attachment references. Writes one `export` access-audit row. Requires `forms.submissions.export`.

Parameters

Name	In	Required	Schema	Description
submissionId	path	Yes	any	—

Responses

200Export document (downloaded as an attachment)

Content-Type: application/json

{}

401Not authenticated

Content-Type: application/json

{
  "error": "string"
}

403Tenant scope required

Content-Type: application/json

{
  "error": "string"
}

404Submission not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/forms/submissions/:submissionId/export" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/forms/submissions/{submissionId}/pdf

Auth required

Download the PDF snapshot of a submitted form

Streams the immutable PDF snapshot, generating it on first request when the on-submit job has not produced it yet. Never re-renders an existing snapshot. Writes an audit row with `access_purpose = "export"`.

Parameters

Name	In	Required	Schema	Description
submissionId	path	Yes	any	—

Responses

200PDF stream

Content-Type: application/pdf

string

404Submission not found or not yet submitted

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/forms/submissions/:submissionId/pdf" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

HR directory

Showing 4 of 4 endpoints

GET/hr_directory/me

Auth required

The caller's own employee card

Always includes the extended fields for the caller themselves, plus the contact editing state.

Responses

200The own card.

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "displayName": "string",
  "firstName": null,
  "lastName": null,
  "workEmail": null,
  "branch": null,
  "position": null,
  "department": null,
  "birthday": null,
  "employmentDate": null,
  "isActive": true,
  "extended": {
    "birthYear": null,
    "mobile": null,
    "sex": null,
    "privateEmail": null,
    "linkedin": null,
    "employmentType": null,
    "company": null,
    "superior": null,
    "buddy": null
  },
  "updatedAt": null,
  "editing": {
    "enabled": true,
    "sandbox": true,
    "canEdit": true
  }
}

400No single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Missing hr_directory.view

Content-Type: application/json

{
  "error": "string"
}

404No active employee card is linked to the account (profile_not_found)

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_directory/me" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/hr_directory/me/contact

Auth required

Update the caller's private email, mobile phone and LinkedIn

Open while hr_records_editing or hr_sandbox_mode is on. Empty values clear a field. Saves through staff.team-members.update and notifies holders of hr_directory.profile_changes.notify about the changed fields (without values).

Request body (application/json)

{
  "privateEmail": null,
  "mobile": null,
  "linkedin": null,
  "updatedAt": "string"
}

Responses

200The own card after the save.

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "displayName": "string",
  "firstName": null,
  "lastName": null,
  "workEmail": null,
  "branch": null,
  "position": null,
  "department": null,
  "birthday": null,
  "employmentDate": null,
  "isActive": true,
  "extended": {
    "birthYear": null,
    "mobile": null,
    "sex": null,
    "privateEmail": null,
    "linkedin": null,
    "employmentType": null,
    "company": null,
    "superior": null,
    "buddy": null
  },
  "updatedAt": null,
  "editing": {
    "enabled": true,
    "sandbox": true,
    "canEdit": true
  }
}

400Malformed body or no single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Missing hr_directory.profile.edit

Content-Type: application/json

{
  "error": "string"
}

404No active employee card is linked to the account (profile_not_found)

Content-Type: application/json

{
  "error": "string"
}

409tomHRM is still the master (records_master_tomhrm) or the card changed since it was loaded

Content-Type: application/json

{
  "error": "string"
}

422Invalid email, phone or LinkedIn URL (validation_failed, fieldErrors)

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/hr_directory/me/contact" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"privateEmail\": null,
  \"mobile\": null,
  \"linkedin\": null,
  \"updatedAt\": \"string\"
}"

GET/hr_directory/people

Auth required

List people in the directory

Active people of the selected organization with the basic fields. Callers with staff.view also get `extended` (HR record fields, birth year) and may pass includeInactive=true.

Parameters

Name	In	Required	Schema	Description
q	query	No	any	—
departmentId	query	No	any	—
branch	query	No	any	—
includeInactive	query	Yes	any	—
sort	query	No	any	—
sortDir	query	No	any	—
page	query	No	any	—
pageSize	query	No	any	—

Responses

200A page of people.

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "displayName": "string",
      "firstName": null,
      "lastName": null,
      "workEmail": null,
      "branch": null,
      "position": null,
      "department": null,
      "birthday": null,
      "employmentDate": null,
      "isActive": true
    }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1,
  "canViewExtended": true,
  "facets": {
    "departments": [
      {
        "id": "00000000-0000-4000-8000-000000000000",
        "name": "string"
      }
    ],
    "branches": [
      "string"
    ]
  }
}

400Invalid query or no single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Missing hr_directory.view, or includeInactive without staff.view

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_directory/people?sort=lastName&sortDir=asc&page=1&pageSize=50" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

GET/hr_directory/people/{id}

Auth required

One person in the directory

Basic fields for every caller; `extended` for callers with staff.view.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200The person.

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "displayName": "string",
  "firstName": null,
  "lastName": null,
  "workEmail": null,
  "branch": null,
  "position": null,
  "department": null,
  "birthday": null,
  "employmentDate": null,
  "isActive": true,
  "canViewExtended": true
}

400No single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Missing hr_directory.view

Content-Type: application/json

{
  "error": "string"
}

404Unknown person, another organization, or inactive and the caller lacks staff.view

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_directory/people/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

HR organisation

Showing 4 of 4 endpoints

PUT/hr_org/departments/{id}

Auth required

Change parent and/or manager

Allowed only while the tenant toggle hr_org_structure_editing is on. Runs the staff team update command (audited, undoable) after checking cycles, self references, active targets in the same organization and the record version.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "parentId": null,
  "managerId": null,
  "updatedAt": "string"
}

Responses

200Saved; returns the new record version.

Content-Type: application/json

{
  "ok": true,
  "updatedAt": null
}

400Invalid payload or no organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Missing hr_org.manage

Content-Type: application/json

{
  "error": "string"
}

404Not an active department of the organization

Content-Type: application/json

{
  "error": "string"
}

409editing_disabled, or the record changed since it was read

Content-Type: application/json

{
  "error": "string"
}

422cycle, self_reference or inactive_target

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/hr_org/departments/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"parentId\": null,
  \"managerId\": null,
  \"updatedAt\": \"string\"
}"

GET/hr_org/members/{id}/lines

Auth required

Department, manager, superior and company of a team member

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Reporting lines.

Content-Type: application/json

{
  "department": null,
  "manager": null,
  "superior": null,
  "company": null,
  "position": null
}

400No single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Missing hr_org.view

Content-Type: application/json

{
  "error": "string"
}

404Not an active team member of the organization

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_org/members/00000000-0000-4000-8000-000000000000/lines" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/hr_org/members/{id}/structure

Auth required

Change department and/or superior

Allowed only while the tenant toggle hr_org_structure_editing is on. Runs the staff update command (audited, undoable) after checking cycles, self references, active targets in the same organization and the record version.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "departmentId": null,
  "superiorId": null,
  "updatedAt": "string"
}

Responses

200Saved; returns the new record version.

Content-Type: application/json

{
  "ok": true,
  "updatedAt": null
}

400Invalid payload or no organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Missing hr_org.manage

Content-Type: application/json

{
  "error": "string"
}

404Not an active team member of the organization

Content-Type: application/json

{
  "error": "string"
}

409editing_disabled, or the record changed since it was read

Content-Type: application/json

{
  "error": "string"
}

422cycle, self_reference or inactive_target

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/hr_org/members/00000000-0000-4000-8000-000000000000/structure" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"departmentId\": null,
  \"superiorId\": null,
  \"updatedAt\": \"string\"
}"

GET/hr_org/structure

Auth required

Departments, people and both reporting lines

Every active department and person of the selected organization with department, department manager, superior, position and company. Versions and structure warnings are returned to holders of hr_org.manage only.

Responses

200Organisation structure.

Content-Type: application/json

{
  "organization": {
    "id": "00000000-0000-4000-8000-000000000000",
    "name": null
  },
  "departments": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "name": "string",
      "parentId": null,
      "managerId": null,
      "memberCount": 1,
      "updatedAt": null
    }
  ],
  "people": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "displayName": "string",
      "position": null,
      "company": null,
      "departmentId": null,
      "superiorId": null,
      "managerId": null,
      "managerIsSelf": true,
      "updatedAt": null
    }
  ],
  "editing": {
    "enabled": true,
    "sandbox": true,
    "allowed": true
  },
  "viewer": {
    "canOpenRecords": true
  }
}

400No single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Missing hr_org.view

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_org/structure" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

HR time tracking

Showing 1 of 1 endpoints

GET/hr_time_tracking/reports/monthly

Auth required

Hours per person and project in one month, with working days under 8 hours

Company-wide. Minutes per person and project, and per person the working days (Mon–Fri, not a PL holiday, company day off or approved leave, inside the employment dates, before today) with less than 480 minutes. Without the hr_time_off calendar the check is off (gapCheck: unavailable).

Parameters

Name	In	Required	Schema	Description
month	query	Yes	any	—

Responses

200People with their gap days, and minutes per person and project.

Content-Type: application/json

{
  "month": "string",
  "from": "string",
  "to": "string",
  "checkedThrough": null,
  "dailyMinutes": 1,
  "gapCheck": "ok",
  "people": [
    {
      "member": {
        "id": "00000000-0000-4000-8000-000000000000",
        "displayName": "string",
        "isActive": true
      },
      "department": null,
      "employmentType": null,
      "minutes": 1,
      "workingDays": null,
      "gapDays": null
    }
  ],
  "items": [
    {
      "memberId": "00000000-0000-4000-8000-000000000000",
      "project": null,
      "minutes": 1
    }
  ]
}

400Invalid month, or no single organization selected

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Missing hr_time_tracking.reports.view

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/hr_time_tracking/reports/monthly?month=string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Planner

Showing 10 of 10 endpoints

GET/planner/availability

Auth required

List availability rules

Returns a paginated collection of availability rules scoped to the authenticated organization.

Parameters

Name	In	Required	Schema	Description
page	query	No	any	—
pageSize	query	No	any	—
subjectType	query	No	any	—
subjectIds	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—
ids	query	No	any	Comma-separated list of record UUIDs to filter by (max 200).

Responses

200Paginated availability rules

Content-Type: application/json

{
  "items": [
    {
      "id": null,
      "organization_id": null,
      "tenant_id": null,
      "subject_type": null,
      "subject_id": null,
      "timezone": null,
      "rrule": null,
      "exdates": null,
      "kind": null,
      "note": null,
      "unavailability_reason_entry_id": null,
      "unavailability_reason_value": null,
      "created_at": null,
      "updated_at": null
    }
  ],
  "total": 1,
  "totalPages": 1
}

Example

curl -X GET "https://hr.office.dac.systems/api/planner/availability?page=1&pageSize=50" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/planner/availability

Auth required

Create availability rule

Creates an availability rule for the selected subject.

Request body (application/json)

{
  "tenantId": "00000000-0000-4000-8000-000000000000",
  "organizationId": "00000000-0000-4000-8000-000000000000",
  "subjectType": "member",
  "subjectId": "00000000-0000-4000-8000-000000000000",
  "timezone": "string",
  "rrule": "string",
  "exdates": [],
  "kind": "availability",
  "note": null,
  "unavailabilityReasonEntryId": null,
  "unavailabilityReasonValue": null
}

Responses

201Availability rule created

Content-Type: application/json

{
  "id": null
}

Example

curl -X POST "https://hr.office.dac.systems/api/planner/availability" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"tenantId\": \"00000000-0000-4000-8000-000000000000\",
  \"organizationId\": \"00000000-0000-4000-8000-000000000000\",
  \"subjectType\": \"member\",
  \"subjectId\": \"00000000-0000-4000-8000-000000000000\",
  \"timezone\": \"string\",
  \"rrule\": \"string\",
  \"exdates\": [],
  \"kind\": \"availability\",
  \"note\": null,
  \"unavailabilityReasonEntryId\": null,
  \"unavailabilityReasonValue\": null
}"

PUT/planner/availability

Auth required

Update availability rule

Updates an availability rule by id.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000",
  "note": null,
  "unavailabilityReasonEntryId": null,
  "unavailabilityReasonValue": null
}

Responses

200Availability rule updated

Content-Type: application/json

{
  "ok": true
}

Example

curl -X PUT "https://hr.office.dac.systems/api/planner/availability" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\",
  \"note\": null,
  \"unavailabilityReasonEntryId\": null,
  \"unavailabilityReasonValue\": null
}"

DELETE/planner/availability

Auth required

Delete availability rule

Deletes an availability rule by id.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000"
}

Responses

200Availability rule deleted

Content-Type: application/json

{
  "ok": true
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/planner/availability" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\"
}"

POST/planner/availability-date-specific

Auth required

Replace date-specific availability

Replaces date-specific availability rules for the subject in a single request.

Request body (application/json)

{
  "tenantId": "00000000-0000-4000-8000-000000000000",
  "organizationId": "00000000-0000-4000-8000-000000000000",
  "subjectType": "member",
  "subjectId": "00000000-0000-4000-8000-000000000000",
  "timezone": "string",
  "windows": [],
  "isAvailable": true,
  "note": null,
  "unavailabilityReasonEntryId": null,
  "unavailabilityReasonValue": null
}

Responses

200Date-specific availability updated

Content-Type: application/json

{
  "ok": true
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Forbidden

Content-Type: application/json

{
  "error": "string"
}

409Conflict — the subject/date availability was modified by another edit

Content-Type: application/json

{
  "error": "string",
  "code": "string",
  "currentUpdatedAt": "string",
  "expectedUpdatedAt": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/planner/availability-date-specific" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"tenantId\": \"00000000-0000-4000-8000-000000000000\",
  \"organizationId\": \"00000000-0000-4000-8000-000000000000\",
  \"subjectType\": \"member\",
  \"subjectId\": \"00000000-0000-4000-8000-000000000000\",
  \"timezone\": \"string\",
  \"windows\": [],
  \"isAvailable\": true,
  \"note\": null,
  \"unavailabilityReasonEntryId\": null,
  \"unavailabilityReasonValue\": null
}"

GET/planner/availability-rule-sets

Auth required

List availability rule sets

Returns a paginated collection of availability rule sets scoped to the authenticated organization.

Parameters

Name	In	Required	Schema	Description
page	query	No	any	—
pageSize	query	No	any	—
ids	query	No	any	Comma-separated list of record UUIDs to filter by (max 200).
search	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—

Responses

200Paginated availability rule sets

Content-Type: application/json

{
  "items": [
    {
      "id": null,
      "organization_id": null,
      "tenant_id": null,
      "name": null,
      "description": null,
      "timezone": null,
      "created_at": null,
      "updated_at": null
    }
  ],
  "total": 1,
  "totalPages": 1
}

Example

curl -X GET "https://hr.office.dac.systems/api/planner/availability-rule-sets?page=1&pageSize=50" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/planner/availability-rule-sets

Auth required

Create availability rule set

Creates a reusable availability rule set.

Request body (application/json)

{
  "tenantId": "00000000-0000-4000-8000-000000000000",
  "organizationId": "00000000-0000-4000-8000-000000000000",
  "name": "string",
  "description": null,
  "timezone": "string"
}

Responses

201Availability rule set created

Content-Type: application/json

{
  "id": null
}

Example

curl -X POST "https://hr.office.dac.systems/api/planner/availability-rule-sets" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"tenantId\": \"00000000-0000-4000-8000-000000000000\",
  \"organizationId\": \"00000000-0000-4000-8000-000000000000\",
  \"name\": \"string\",
  \"description\": null,
  \"timezone\": \"string\"
}"

PUT/planner/availability-rule-sets

Auth required

Update availability rule set

Updates an availability rule set by id.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000",
  "description": null
}

Responses

200Availability rule set updated

Content-Type: application/json

{
  "ok": true
}

Example

curl -X PUT "https://hr.office.dac.systems/api/planner/availability-rule-sets" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\",
  \"description\": null
}"

DELETE/planner/availability-rule-sets

Auth required

Delete availability rule set

Deletes an availability rule set by id.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000"
}

Responses

200Availability rule set deleted

Content-Type: application/json

{
  "ok": true
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/planner/availability-rule-sets" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\"
}"

POST/planner/availability-weekly

Auth required

Replace weekly availability

Replaces weekly availability rules for the subject in a single request.

Request body (application/json)

{
  "tenantId": "00000000-0000-4000-8000-000000000000",
  "organizationId": "00000000-0000-4000-8000-000000000000",
  "subjectType": "member",
  "subjectId": "00000000-0000-4000-8000-000000000000",
  "timezone": "string",
  "windows": []
}

Responses

200Weekly availability updated

Content-Type: application/json

{
  "ok": true
}

400Invalid payload

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Forbidden

Content-Type: application/json

{
  "error": "string"
}

409Optimistic lock conflict

Content-Type: application/json

{
  "error": "string",
  "code": "optimistic_lock_conflict",
  "currentUpdatedAt": "string",
  "expectedUpdatedAt": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/planner/availability-weekly" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"tenantId\": \"00000000-0000-4000-8000-000000000000\",
  \"organizationId\": \"00000000-0000-4000-8000-000000000000\",
  \"subjectType\": \"member\",
  \"subjectId\": \"00000000-0000-4000-8000-000000000000\",
  \"timezone\": \"string\",
  \"windows\": []
}"

Query Index

Showing 3 of 3 endpoints

POST/query_index/purge

Auth required

Purge query index records

Queues a purge job to remove indexed records for an entity type within the active scope.

Request body (application/json)

{
  "entityType": "string"
}

Responses

200Purge job accepted.

Content-Type: application/json

{
  "ok": true
}

400Missing entity type

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/query_index/purge" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityType\": \"string\"
}"

POST/query_index/reindex

Auth required

Trigger query index rebuild

Queues a reindex job for the specified entity type within the current tenant scope.

Request body (application/json)

{
  "entityType": "string"
}

Responses

200Reindex job accepted.

Content-Type: application/json

{
  "ok": true
}

400Missing entity type

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/query_index/reindex" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"entityType\": \"string\"
}"

GET/query_index/status

Auth required

Inspect query index coverage

Returns entity counts comparing base tables with the query index along with the latest job status.

Responses

200Current query index status.

Content-Type: application/json

{
  "items": [
    {
      "entityId": "string",
      "label": "string",
      "baseCount": null,
      "indexCount": null,
      "vectorCount": null,
      "fulltextCount": null,
      "ok": true,
      "job": {
        "status": "idle",
        "startedAt": null,
        "finishedAt": null,
        "heartbeatAt": null,
        "processedCount": null,
        "totalCount": null,
        "scope": null
      },
      "refreshedAt": null
    }
  ],
  "errors": [
    {
      "id": "string",
      "source": "string",
      "handler": "string",
      "entityType": null,
      "recordId": null,
      "tenantId": null,
      "organizationId": null,
      "message": "string",
      "stack": null,
      "payload": null,
      "occurredAt": "string"
    }
  ],
  "logs": [
    {
      "id": "string",
      "source": "string",
      "handler": "string",
      "level": "info",
      "entityType": null,
      "recordId": null,
      "tenantId": null,
      "organizationId": null,
      "message": "string",
      "details": null,
      "occurredAt": "string"
    }
  ]
}

400Tenant or organization context required

Content-Type: application/json

{
  "error": "string"
}

401Authentication required

Content-Type: application/json

{
  "error": "string"
}

403Organization access denied

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/query_index/status" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Staff

Showing 20 of 100 endpoints

GET/staff/activities

Auth required

List teammemberactivitys

Returns a paginated collection of teammemberactivitys scoped to the authenticated organization.

Parameters

Name	In	Required	Schema	Description
page	query	No	any	—
pageSize	query	No	any	—
entityId	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—
ids	query	No	any	Comma-separated list of record UUIDs to filter by (max 200).

Responses

200Paginated teammemberactivitys

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "member_id": null,
      "activity_type": null,
      "subject": null,
      "body": null,
      "occurred_at": null,
      "author_user_id": null,
      "appearance_icon": null,
      "appearance_color": null,
      "organization_id": null,
      "tenant_id": null,
      "created_at": null,
      "updated_at": null
    }
  ],
  "total": 1,
  "totalPages": 1
}

Example

curl -X GET "https://hr.office.dac.systems/api/staff/activities?page=1&pageSize=50" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/staff/activities

Auth required

Create teammemberactivity

Adds an activity to a team member timeline.

Request body (application/json)

{
  "tenantId": "00000000-0000-4000-8000-000000000000",
  "organizationId": "00000000-0000-4000-8000-000000000000",
  "entityId": "00000000-0000-4000-8000-000000000000",
  "activityType": "string",
  "appearanceIcon": null,
  "appearanceColor": null
}

Responses

201TeamMemberActivity created

Content-Type: application/json

{
  "id": null,
  "authorUserId": null
}

Example

curl -X POST "https://hr.office.dac.systems/api/staff/activities" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"tenantId\": \"00000000-0000-4000-8000-000000000000\",
  \"organizationId\": \"00000000-0000-4000-8000-000000000000\",
  \"entityId\": \"00000000-0000-4000-8000-000000000000\",
  \"activityType\": \"string\",
  \"appearanceIcon\": null,
  \"appearanceColor\": null
}"

PUT/staff/activities

Auth required

Update teammemberactivity

Updates a team member activity.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000",
  "appearanceIcon": null,
  "appearanceColor": null
}

Responses

200TeamMemberActivity updated

Content-Type: application/json

{
  "ok": true
}

Example

curl -X PUT "https://hr.office.dac.systems/api/staff/activities" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\",
  \"appearanceIcon\": null,
  \"appearanceColor\": null
}"

DELETE/staff/activities

Auth required

Delete teammemberactivity

Deletes a team member activity.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000"
}

Responses

200TeamMemberActivity deleted

Content-Type: application/json

{
  "ok": true
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/staff/activities" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\"
}"

GET/staff/addresses

Auth required

List teammemberaddresss

Returns a paginated collection of teammemberaddresss scoped to the authenticated organization.

Parameters

Name	In	Required	Schema	Description
page	query	No	any	—
pageSize	query	No	any	—
entityId	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—
ids	query	No	any	Comma-separated list of record UUIDs to filter by (max 200).

Responses

200Paginated teammemberaddresss

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "member_id": null,
      "name": null,
      "purpose": null,
      "company_name": null,
      "address_line1": null,
      "address_line2": null,
      "building_number": null,
      "flat_number": null,
      "city": null,
      "region": null,
      "postal_code": null,
      "country": null,
      "latitude": null,
      "longitude": null,
      "is_primary": null,
      "organization_id": null,
      "tenant_id": null,
      "created_at": null,
      "updated_at": null
    }
  ],
  "total": 1,
  "totalPages": 1
}

Example

curl -X GET "https://hr.office.dac.systems/api/staff/addresses?page=1&pageSize=50" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/staff/addresses

Auth required

Create teammemberaddress

Adds a team member address.

Request body (application/json)

{
  "tenantId": "00000000-0000-4000-8000-000000000000",
  "organizationId": "00000000-0000-4000-8000-000000000000",
  "entityId": "00000000-0000-4000-8000-000000000000",
  "addressLine1": "string"
}

Responses

201TeamMemberAddress created

Content-Type: application/json

{
  "id": null
}

Example

curl -X POST "https://hr.office.dac.systems/api/staff/addresses" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"tenantId\": \"00000000-0000-4000-8000-000000000000\",
  \"organizationId\": \"00000000-0000-4000-8000-000000000000\",
  \"entityId\": \"00000000-0000-4000-8000-000000000000\",
  \"addressLine1\": \"string\"
}"

PUT/staff/addresses

Auth required

Update teammemberaddress

Updates a team member address.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000"
}

Responses

200TeamMemberAddress updated

Content-Type: application/json

{
  "ok": true
}

Example

curl -X PUT "https://hr.office.dac.systems/api/staff/addresses" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\"
}"

DELETE/staff/addresses

Auth required

Delete teammemberaddress

Deletes a team member address.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000"
}

Responses

200TeamMemberAddress deleted

Content-Type: application/json

{
  "ok": true
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/staff/addresses" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\"
}"

GET/staff/comments

Auth required

List teammembercomments

Returns a paginated collection of teammembercomments scoped to the authenticated organization.

Parameters

Name	In	Required	Schema	Description
page	query	No	any	—
pageSize	query	No	any	—
entityId	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—
ids	query	No	any	Comma-separated list of record UUIDs to filter by (max 200).

Responses

200Paginated teammembercomments

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "member_id": null,
      "body": null,
      "author_user_id": null,
      "appearance_icon": null,
      "appearance_color": null,
      "organization_id": null,
      "tenant_id": null,
      "created_at": null,
      "updated_at": null
    }
  ],
  "total": 1,
  "totalPages": 1
}

Example

curl -X GET "https://hr.office.dac.systems/api/staff/comments?page=1&pageSize=50" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/staff/comments

Auth required

Create teammembercomment

Adds a note to a team member timeline.

Request body (application/json)

{
  "tenantId": "00000000-0000-4000-8000-000000000000",
  "organizationId": "00000000-0000-4000-8000-000000000000",
  "entityId": "00000000-0000-4000-8000-000000000000",
  "body": "string",
  "appearanceIcon": null,
  "appearanceColor": null
}

Responses

201TeamMemberComment created

Content-Type: application/json

{
  "id": null,
  "authorUserId": null
}

Example

curl -X POST "https://hr.office.dac.systems/api/staff/comments" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"tenantId\": \"00000000-0000-4000-8000-000000000000\",
  \"organizationId\": \"00000000-0000-4000-8000-000000000000\",
  \"entityId\": \"00000000-0000-4000-8000-000000000000\",
  \"body\": \"string\",
  \"appearanceIcon\": null,
  \"appearanceColor\": null
}"

PUT/staff/comments

Auth required

Update teammembercomment

Updates a team member note.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000",
  "appearanceIcon": null,
  "appearanceColor": null
}

Responses

200TeamMemberComment updated

Content-Type: application/json

{
  "ok": true
}

Example

curl -X PUT "https://hr.office.dac.systems/api/staff/comments" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\",
  \"appearanceIcon\": null,
  \"appearanceColor\": null
}"

DELETE/staff/comments

Auth required

Delete teammembercomment

Deletes a team member note.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000"
}

Responses

200TeamMemberComment deleted

Content-Type: application/json

{
  "ok": true
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/staff/comments" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\"
}"

GET/staff/job-histories

Auth required

List teammemberjobhistorys

Returns a paginated collection of teammemberjobhistorys scoped to the authenticated organization.

Parameters

Name	In	Required	Schema	Description
page	query	No	any	—
pageSize	query	No	any	—
entityId	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—
ids	query	No	any	Comma-separated list of record UUIDs to filter by (max 200).

Responses

200Paginated teammemberjobhistorys

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "member_id": null,
      "name": null,
      "company_name": null,
      "description": null,
      "start_date": null,
      "end_date": null,
      "organization_id": null,
      "tenant_id": null,
      "created_at": null,
      "updated_at": null
    }
  ],
  "total": 1,
  "totalPages": 1
}

Example

curl -X GET "https://hr.office.dac.systems/api/staff/job-histories?page=1&pageSize=50" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/staff/job-histories

Auth required

Create teammemberjobhistory

Adds a team member job history entry.

Request body (application/json)

{
  "tenantId": "00000000-0000-4000-8000-000000000000",
  "organizationId": "00000000-0000-4000-8000-000000000000",
  "entityId": "00000000-0000-4000-8000-000000000000",
  "name": "string",
  "companyName": null,
  "description": null,
  "startDate": "2025-01-01T00:00:00.000Z",
  "endDate": null
}

Responses

201TeamMemberJobHistory created

Content-Type: application/json

{
  "id": null
}

Example

curl -X POST "https://hr.office.dac.systems/api/staff/job-histories" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"tenantId\": \"00000000-0000-4000-8000-000000000000\",
  \"organizationId\": \"00000000-0000-4000-8000-000000000000\",
  \"entityId\": \"00000000-0000-4000-8000-000000000000\",
  \"name\": \"string\",
  \"companyName\": null,
  \"description\": null,
  \"startDate\": \"2025-01-01T00:00:00.000Z\",
  \"endDate\": null
}"

PUT/staff/job-histories

Auth required

Update teammemberjobhistory

Updates a team member job history entry.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000",
  "companyName": null,
  "description": null,
  "endDate": null
}

Responses

200TeamMemberJobHistory updated

Content-Type: application/json

{
  "ok": true
}

Example

curl -X PUT "https://hr.office.dac.systems/api/staff/job-histories" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\",
  \"companyName\": null,
  \"description\": null,
  \"endDate\": null
}"

DELETE/staff/job-histories

Auth required

Delete teammemberjobhistory

Deletes a team member job history entry.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000"
}

Responses

200TeamMemberJobHistory deleted

Content-Type: application/json

{
  "ok": true
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/staff/job-histories" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\"
}"

GET/staff/leave-requests

Auth required

List leave requests

Returns a paginated collection of leave requests scoped to the authenticated organization.

Parameters

Name	In	Required	Schema	Description
page	query	No	any	—
pageSize	query	No	any	—
search	query	No	any	—
status	query	No	any	—
memberId	query	No	any	—
ids	query	No	any	Comma-separated list of record UUIDs to filter by (max 200).
sortField	query	No	any	—
sortDir	query	No	any	—

Responses

200Paginated leave requests

Content-Type: application/json

{
  "items": [
    {
      "id": null,
      "organization_id": null,
      "tenant_id": null,
      "member_id": null,
      "start_date": null,
      "end_date": null,
      "timezone": null,
      "status": null,
      "unavailability_reason_entry_id": null,
      "unavailability_reason_value": null,
      "note": null,
      "decision_comment": null,
      "submitted_by_user_id": null,
      "decided_by_user_id": null,
      "decided_at": null,
      "created_at": null,
      "updated_at": null,
      "member": null
    }
  ],
  "total": 1,
  "totalPages": 1
}

Example

curl -X GET "https://hr.office.dac.systems/api/staff/leave-requests?page=1&pageSize=50" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

POST/staff/leave-requests

Auth required

Create leave request

Creates a leave request for a staff member.

Request body (application/json)

{
  "tenantId": "00000000-0000-4000-8000-000000000000",
  "organizationId": "00000000-0000-4000-8000-000000000000",
  "memberId": "00000000-0000-4000-8000-000000000000",
  "timezone": "string",
  "startDate": "2025-01-01T00:00:00.000Z",
  "endDate": "2025-01-01T00:00:00.000Z",
  "unavailabilityReasonEntryId": null,
  "unavailabilityReasonValue": null,
  "note": null,
  "submittedByUserId": null
}

Responses

201Leave request created

Content-Type: application/json

{
  "id": null
}

Example

curl -X POST "https://hr.office.dac.systems/api/staff/leave-requests" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"tenantId\": \"00000000-0000-4000-8000-000000000000\",
  \"organizationId\": \"00000000-0000-4000-8000-000000000000\",
  \"memberId\": \"00000000-0000-4000-8000-000000000000\",
  \"timezone\": \"string\",
  \"startDate\": \"2025-01-01T00:00:00.000Z\",
  \"endDate\": \"2025-01-01T00:00:00.000Z\",
  \"unavailabilityReasonEntryId\": null,
  \"unavailabilityReasonValue\": null,
  \"note\": null,
  \"submittedByUserId\": null
}"

PUT/staff/leave-requests

Auth required

Update leave request

Updates a leave request by id.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000",
  "unavailabilityReasonEntryId": null,
  "unavailabilityReasonValue": null,
  "note": null
}

Responses

200Leave request updated

Content-Type: application/json

{
  "ok": true
}

Example

curl -X PUT "https://hr.office.dac.systems/api/staff/leave-requests" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\",
  \"unavailabilityReasonEntryId\": null,
  \"unavailabilityReasonValue\": null,
  \"note\": null
}"

DELETE/staff/leave-requests

Auth required

Delete leave request

Deletes a leave request by id.

Request body (application/json)

{
  "id": "00000000-0000-4000-8000-000000000000"
}

Responses

200Leave request deleted

Content-Type: application/json

{
  "ok": true
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/staff/leave-requests" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"id\": \"00000000-0000-4000-8000-000000000000\"
}"

Staff Portal

Showing 2 of 2 endpoints

GET/staff/portal/time-reports

List the signed-in customer’s closed time reports

Returns the closed, non-deleted `staff_time_reports` rows whose `customer_id` matches the portal session’s own customer entity, inside that session’s tenant and organization. Draft reports are never listed. The response carries hours only — no rate, cost, amount or currency — because `staff.timesheets.rates.view` is a staff feature a portal identity cannot hold.

Parameters

Name	In	Required	Schema	Description
page	query	No	any	—
pageSize	query	No	any	—

Responses

200Closed reports for the signed-in customer

Content-Type: application/json

{
  "items": [
    {
      "id": "00000000-0000-4000-8000-000000000000",
      "reference": "string",
      "title": "string",
      "periodFrom": "string",
      "periodTo": "string",
      "closedAt": null,
      "totalBillableMinutes": 1,
      "totalNonbillableMinutes": 1
    }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1,
  "totalPages": 1
}

401Not signed in to the portal

Content-Type: application/json

{
  "ok": false,
  "error": "string"
}

403The portal account is not linked to a customer

Content-Type: application/json

{
  "ok": false,
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/staff/portal/time-reports?page=1&pageSize=20" \
  -H "Accept: application/json"

GET/staff/portal/time-reports/{id}

Read one closed time report belonging to the signed-in customer

Loads the report by id **together with** the tenant, organization, customer and closed-status predicates, so a report belonging to another customer of the same organization answers 404. Returns the frozen minute totals per project; no rate, cost, amount or currency is present in the response.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200The report

Content-Type: application/json

{
  "id": "00000000-0000-4000-8000-000000000000",
  "reference": "string",
  "title": "string",
  "periodFrom": "string",
  "periodTo": "string",
  "closedAt": null,
  "totalBillableMinutes": 1,
  "totalNonbillableMinutes": 1,
  "projects": [
    {
      "timeProjectId": null,
      "projectName": null,
      "billableMinutes": 1,
      "nonbillableMinutes": 1
    }
  ]
}

401Not signed in to the portal

Content-Type: application/json

{
  "ok": false,
  "error": "string"
}

403The portal account is not linked to a customer

Content-Type: application/json

{
  "ok": false,
  "error": "string"
}

404No closed report with that id belongs to this customer

Content-Type: application/json

{
  "ok": false,
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/staff/portal/time-reports/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json"

Translations

Showing 3 of 3 endpoints

GET/translations/{entityType}/{entityId}

Auth required

Get entity translations

Returns the full translation record for a single entity.

Parameters

Name	In	Required	Schema	Description
entityType	path	Yes	any	—
entityId	path	Yes	any	—

Responses

200Translation record found.

Content-Type: application/json

"string"

401Authentication required

Content-Type: application/json

"string"

404No translations found for this entity

Content-Type: application/json

"string"

Example

curl -X GET "https://hr.office.dac.systems/api/translations/string/string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/translations/{entityType}/{entityId}

Auth required

Create or update entity translations

Full replacement of translations JSONB for an entity.

Parameters

Name	In	Required	Schema	Description
entityType	path	Yes	any	—
entityId	path	Yes	any	—

Responses

200Translations saved.

Content-Type: application/json

"string"

400Validation failed

Content-Type: application/json

"string"

401Authentication required

Content-Type: application/json

"string"

Example

curl -X PUT "https://hr.office.dac.systems/api/translations/string/string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

DELETE/translations/{entityType}/{entityId}

Auth required

Delete entity translations

Removes all translations for an entity.

Parameters

Name	In	Required	Schema	Description
entityType	path	Yes	any	—
entityId	path	Yes	any	—

Responses

204Translations deleted.

No response body.

401Authentication required

Content-Type: application/json

"string"

Example

curl -X DELETE "https://hr.office.dac.systems/api/translations/string/string" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

Workflows

Showing 20 of 56 endpoints

GET/workflows/command-settings

Auth required

List workflow-safe command candidates with tenant enablement

Returns every command declared through registerWorkflowSafeCommands together with whether this tenant has switched it on. `configured: false` means the tenant has never saved the setting and the answers come from the grandfathered defaults.

Responses

200Catalogue with tenant enablement

Content-Type: application/json

{
  "configured": true,
  "items": [
    {
      "commandId": "string",
      "requiredFeatures": [
        "string"
      ],
      "labelKey": null
    }
  ]
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/workflows/command-settings" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>"

PUT/workflows/command-settings

Auth required

Set which workflow-safe commands are enabled for the tenant

Replaces the tenant's enabled set. Every submitted id must be present in the code-declared catalogue; an unknown id is rejected with 400 rather than stored. Stored ids whose declaring module is not loaded in this process are retained so a save can never silently untick them.

Request body (application/json)

{
  "enabledCommandIds": [
    "string"
  ]
}

Responses

200Updated enablement

Content-Type: application/json

{
  "configured": true,
  "items": [
    {
      "commandId": "string",
      "requiredFeatures": [
        "string"
      ],
      "labelKey": null
    }
  ],
  "ok": true
}

400Invalid payload or unknown command id

Content-Type: application/json

{
  "error": "string"
}

401Missing authentication

Content-Type: application/json

{
  "error": "string"
}

503Settings storage unavailable

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/workflows/command-settings" \
  -H "Accept: application/json" \
  -H "authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d "{
  \"enabledCommandIds\": [
    \"string\"
  ]
}"

GET/workflows/commands

List commands allowlisted for UPDATE_ENTITY activities

Returns the registered workflow-safe command catalogue consumed by the UPDATE_ENTITY command picker, each entry carrying whether the caller's tenant has enabled it. Entries with enabled:false, and commands outside the catalogue entirely, can still be authored but fail at runtime.

Responses

200Allowlisted workflow-safe commands

Content-Type: application/json

{
  "items": [
    {
      "commandId": "string",
      "requiredFeatures": [
        "string"
      ],
      "labelKey": null
    }
  ]
}

400Missing tenant context

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Insufficient permissions

Content-Type: application/json

{
  "error": "string"
}

500Internal server error

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/workflows/commands" \
  -H "Accept: application/json"

GET/workflows/definitions

List workflow definitions

Get a list of workflow definitions with optional filters. Supports pagination and search.

Parameters

Name	In	Required	Schema	Description
workflowId	query	Yes	any	—
enabled	query	No	any	—
search	query	No	any	—
limit	query	No	any	—
offset	query	No	any	—

Responses

200List of workflow definitions with pagination

Content-Type: application/json

{
  "data": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "workflowId": "checkout-flow",
      "workflowName": "Checkout Flow",
      "description": "Complete checkout workflow for processing orders",
      "version": 1,
      "definition": {
        "steps": [
          {
            "stepId": "start",
            "stepName": "Start",
            "stepType": "START"
          },
          {
            "stepId": "validate-cart",
            "stepName": "Validate Cart",
            "stepType": "AUTOMATED"
          },
          {
            "stepId": "end",
            "stepName": "End",
            "stepType": "END"
          }
        ],
        "transitions": [
          {
            "transitionId": "start-to-validate",
            "fromStepId": "start",
            "toStepId": "validate-cart",
            "trigger": "auto"
          },
          {
            "transitionId": "validate-to-end",
            "fromStepId": "validate-cart",
            "toStepId": "end",
            "trigger": "auto"
          }
        ]
      },
      "enabled": true,
      "tenantId": "123e4567-e89b-12d3-a456-426614174001",
      "organizationId": "123e4567-e89b-12d3-a456-426614174002",
      "createdAt": "2025-12-08T10:00:00.000Z",
      "updatedAt": "2025-12-08T10:00:00.000Z"
    }
  ],
  "pagination": {
    "total": 1,
    "limit": 50,
    "offset": 0,
    "hasMore": false
  }
}

Example

curl -X GET "https://hr.office.dac.systems/api/workflows/definitions?workflowId=string&limit=50&offset=0" \
  -H "Accept: application/json"

POST/workflows/definitions

Create workflow definition

Create a new workflow definition. The definition must include at least START and END steps with at least one transition connecting them.

Request body (application/json)

{
  "workflowId": "checkout-flow",
  "workflowName": "Checkout Flow",
  "description": "Complete checkout workflow for processing orders",
  "version": 1,
  "definition": {
    "steps": [
      {
        "stepId": "start",
        "stepName": "Start",
        "stepType": "START"
      },
      {
        "stepId": "validate-cart",
        "stepName": "Validate Cart",
        "stepType": "AUTOMATED",
        "description": "Validate cart items and check inventory"
      },
      {
        "stepId": "payment",
        "stepName": "Process Payment",
        "stepType": "AUTOMATED",
        "description": "Charge payment method",
        "retryPolicy": {
          "maxAttempts": 3,
          "backoffMs": 1000
        }
      },
      {
        "stepId": "end",
        "stepName": "End",
        "stepType": "END"
      }
    ],
    "transitions": [
      {
        "transitionId": "start-to-validate",
        "fromStepId": "start",
        "toStepId": "validate-cart",
        "trigger": "auto"
      },
      {
        "transitionId": "validate-to-payment",
        "fromStepId": "validate-cart",
        "toStepId": "payment",
        "trigger": "auto"
      },
      {
        "transitionId": "payment-to-end",
        "fromStepId": "payment",
        "toStepId": "end",
        "trigger": "auto",
        "activities": [
          {
            "activityName": "Send Order Confirmation",
            "activityType": "SEND_EMAIL",
            "config": {
              "to": "{{context.customerEmail}}",
              "subject": "Order Confirmation #{{context.orderId}}",
              "template": "order_confirmation"
            }
          }
        ]
      }
    ]
  },
  "enabled": true
}

Responses

201Workflow definition created successfully

Content-Type: application/json

{
  "data": {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "workflowId": "checkout-flow",
    "workflowName": "Checkout Flow",
    "description": "Complete checkout workflow for processing orders",
    "version": 1,
    "definition": {
      "steps": [
        {
          "stepId": "start",
          "stepName": "Start",
          "stepType": "START"
        },
        {
          "stepId": "validate-cart",
          "stepName": "Validate Cart",
          "stepType": "AUTOMATED"
        },
        {
          "stepId": "payment",
          "stepName": "Process Payment",
          "stepType": "AUTOMATED"
        },
        {
          "stepId": "end",
          "stepName": "End",
          "stepType": "END"
        }
      ],
      "transitions": [
        {
          "transitionId": "start-to-validate",
          "fromStepId": "start",
          "toStepId": "validate-cart",
          "trigger": "auto"
        },
        {
          "transitionId": "validate-to-payment",
          "fromStepId": "validate-cart",
          "toStepId": "payment",
          "trigger": "auto"
        },
        {
          "transitionId": "payment-to-end",
          "fromStepId": "payment",
          "toStepId": "end",
          "trigger": "auto"
        }
      ]
    },
    "enabled": true,
    "tenantId": "123e4567-e89b-12d3-a456-426614174001",
    "organizationId": "123e4567-e89b-12d3-a456-426614174002",
    "createdAt": "2025-12-08T10:00:00.000Z",
    "updatedAt": "2025-12-08T10:00:00.000Z"
  },
  "message": "Workflow definition created successfully"
}

400Validation error - invalid workflow structure

Content-Type: application/json

{
  "error": "Validation failed",
  "details": [
    {
      "path": [
        "definition",
        "steps"
      ],
      "code": "custom",
      "message": "Workflow must have at least START and END steps"
    }
  ]
}

409Conflict - workflow with same ID and version already exists

Content-Type: application/json

{
  "error": "Workflow definition with ID \"checkout-flow\" and version 1 already exists"
}

Example

curl -X POST "https://hr.office.dac.systems/api/workflows/definitions" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "{
  \"workflowId\": \"string\",
  \"workflowName\": \"string\",
  \"description\": null,
  \"version\": 1,
  \"definition\": {
    \"steps\": [
      {
        \"stepId\": \"string\",
        \"stepName\": \"string\",
        \"stepType\": \"START\"
      }
    ],
    \"transitions\": [
      {
        \"transitionId\": \"string\",
        \"fromStepId\": \"string\",
        \"toStepId\": \"string\",
        \"trigger\": \"auto\",
        \"condition\": null,
        \"continueOnActivityFailure\": false,
        \"priority\": 0
      }
    ]
  },
  \"metadata\": null,
  \"enabled\": true,
  \"grantedFeatures\": null
}"

GET/workflows/definitions/{id}

Get workflow definition

Get a single workflow definition by ID. Returns the complete workflow structure including steps and transitions (with embedded activities).

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	UUID for DB definitions, or "code:<workflowId>" for code-based definitions

Responses

200Workflow definition found

Content-Type: application/json

{
  "data": {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "workflowId": "checkout-flow",
    "workflowName": "Checkout Flow",
    "description": "Complete checkout workflow for processing orders",
    "version": 1,
    "definition": {
      "steps": [
        {
          "stepId": "start",
          "stepName": "Start",
          "stepType": "START"
        },
        {
          "stepId": "validate-cart",
          "stepName": "Validate Cart",
          "stepType": "AUTOMATED",
          "description": "Validate cart items and check inventory"
        },
        {
          "stepId": "payment",
          "stepName": "Process Payment",
          "stepType": "AUTOMATED",
          "description": "Charge payment method",
          "retryPolicy": {
            "maxAttempts": 3,
            "backoffMs": 1000
          }
        },
        {
          "stepId": "end",
          "stepName": "End",
          "stepType": "END"
        }
      ],
      "transitions": [
        {
          "transitionId": "start-to-validate",
          "fromStepId": "start",
          "toStepId": "validate-cart",
          "trigger": "auto"
        },
        {
          "transitionId": "validate-to-payment",
          "fromStepId": "validate-cart",
          "toStepId": "payment",
          "trigger": "auto"
        },
        {
          "transitionId": "payment-to-end",
          "fromStepId": "payment",
          "toStepId": "end",
          "trigger": "auto",
          "activities": [
            {
              "activityName": "Send Order Confirmation",
              "activityType": "SEND_EMAIL",
              "config": {
                "to": "{{context.customerEmail}}",
                "subject": "Order Confirmation #{{context.orderId}}",
                "template": "order_confirmation"
              }
            }
          ]
        }
      ]
    },
    "enabled": true,
    "tenantId": "123e4567-e89b-12d3-a456-426614174001",
    "organizationId": "123e4567-e89b-12d3-a456-426614174002",
    "createdAt": "2025-12-08T10:00:00.000Z",
    "updatedAt": "2025-12-08T10:00:00.000Z"
  }
}

404Workflow definition not found

Content-Type: application/json

{
  "error": "Workflow definition not found"
}

Example

curl -X GET "https://hr.office.dac.systems/api/workflows/definitions/string" \
  -H "Accept: application/json"

PUT/workflows/definitions/{id}

Update workflow definition

Update an existing workflow definition. Supports partial updates - only provided fields will be updated.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Request body (application/json)

{
  "definition": {
    "steps": [
      {
        "stepId": "start",
        "stepName": "Start",
        "stepType": "START"
      },
      {
        "stepId": "validate-cart",
        "stepName": "Validate Cart",
        "stepType": "AUTOMATED"
      },
      {
        "stepId": "payment",
        "stepName": "Process Payment",
        "stepType": "AUTOMATED"
      },
      {
        "stepId": "confirmation",
        "stepName": "Order Confirmation",
        "stepType": "AUTOMATED"
      },
      {
        "stepId": "end",
        "stepName": "End",
        "stepType": "END"
      }
    ],
    "transitions": [
      {
        "transitionId": "start-to-validate",
        "fromStepId": "start",
        "toStepId": "validate-cart",
        "trigger": "auto"
      },
      {
        "transitionId": "validate-to-payment",
        "fromStepId": "validate-cart",
        "toStepId": "payment",
        "trigger": "auto"
      },
      {
        "transitionId": "payment-to-confirmation",
        "fromStepId": "payment",
        "toStepId": "confirmation",
        "trigger": "auto"
      },
      {
        "transitionId": "confirmation-to-end",
        "fromStepId": "confirmation",
        "toStepId": "end",
        "trigger": "auto"
      }
    ]
  },
  "enabled": true
}

Responses

200Workflow definition updated successfully

Content-Type: application/json

{
  "data": {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "workflowId": "checkout-flow",
    "workflowName": "Checkout Flow",
    "description": "Complete checkout workflow for processing orders",
    "version": 1,
    "definition": {
      "steps": [
        {
          "stepId": "start",
          "stepName": "Start",
          "stepType": "START"
        },
        {
          "stepId": "validate-cart",
          "stepName": "Validate Cart",
          "stepType": "AUTOMATED"
        },
        {
          "stepId": "payment",
          "stepName": "Process Payment",
          "stepType": "AUTOMATED"
        },
        {
          "stepId": "confirmation",
          "stepName": "Order Confirmation",
          "stepType": "AUTOMATED"
        },
        {
          "stepId": "end",
          "stepName": "End",
          "stepType": "END"
        }
      ],
      "transitions": [
        {
          "transitionId": "start-to-validate",
          "fromStepId": "start",
          "toStepId": "validate-cart",
          "trigger": "auto"
        },
        {
          "transitionId": "validate-to-payment",
          "fromStepId": "validate-cart",
          "toStepId": "payment",
          "trigger": "auto"
        },
        {
          "transitionId": "payment-to-confirmation",
          "fromStepId": "payment",
          "toStepId": "confirmation",
          "trigger": "auto"
        },
        {
          "transitionId": "confirmation-to-end",
          "fromStepId": "confirmation",
          "toStepId": "end",
          "trigger": "auto"
        }
      ]
    },
    "enabled": true,
    "tenantId": "123e4567-e89b-12d3-a456-426614174001",
    "organizationId": "123e4567-e89b-12d3-a456-426614174002",
    "createdAt": "2025-12-08T10:00:00.000Z",
    "updatedAt": "2025-12-08T11:30:00.000Z"
  },
  "message": "Workflow definition updated successfully"
}

400Validation error

Content-Type: application/json

{
  "error": "Validation failed",
  "details": [
    {
      "path": [
        "definition"
      ],
      "code": "invalid_type",
      "message": "Invalid input: expected object, received string",
      "expected": "object",
      "got": "string"
    }
  ]
}

404Workflow definition not found

Content-Type: application/json

{
  "error": "Workflow definition not found"
}

409Structural change refused while instances are still running (or optimistic-lock conflict). Publish a new version and apply the change there.

Content-Type: application/json

{
  "error": "Structural changes require a new version while instances are still running",
  "code": "WORKFLOW_STRUCTURAL_EDIT_REQUIRES_NEW_VERSION",
  "definitionId": "123e4567-e89b-12d3-a456-426614174000",
  "activeInstanceCount": 3,
  "activeStatuses": [
    "RUNNING",
    "PAUSED",
    "WAITING_FOR_ACTIVITIES",
    "FORKED",
    "COMPENSATING"
  ],
  "changes": [
    {
      "kind": "transitionRetargeted",
      "id": "t_lz3k9_ab12cd34e"
    }
  ],
  "remedy": {
    "action": "createVersion",
    "method": "POST",
    "endpoint": "/api/workflows/definitions/123e4567-e89b-12d3-a456-426614174000/publish"
  }
}

Example

curl -X PUT "https://hr.office.dac.systems/api/workflows/definitions/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "{
  \"description\": null,
  \"metadata\": null,
  \"effectiveFrom\": null,
  \"effectiveTo\": null,
  \"grantedFeatures\": null
}"

DELETE/workflows/definitions/{id}

Delete workflow definition

Soft delete a workflow definition. Cannot be deleted if there are active workflow instances (RUNNING or WAITING status) using this definition.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Workflow definition deleted successfully

Content-Type: application/json

{
  "message": "Workflow definition deleted successfully"
}

404Workflow definition not found

Content-Type: application/json

{
  "error": "Workflow definition not found"
}

409Cannot delete - active workflow instances exist

Content-Type: application/json

{
  "error": "Cannot delete workflow definition with 3 active instance(s)"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/workflows/definitions/00000000-0000-4000-8000-000000000000" \
  -H "Accept: application/json"

GET/workflows/definitions/{id}/callers

List sub-workflow callers and breaking mappings

Returns parent definitions that invoke this workflow as a sub-workflow and the mappings its current port contract would break.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	Workflow definition id

Responses

200Callers

Content-Type: application/json

{
  "callers": [
    {
      "workflowId": "order-flow",
      "version": 1,
      "stepId": "sub",
      "brokenMappings": [
        "input:orderId"
      ]
    }
  ]
}

404Not found

Content-Type: application/json

{
  "error": "Workflow definition not found"
}

Example

curl -X GET "https://hr.office.dac.systems/api/workflows/definitions/string/callers" \
  -H "Accept: application/json"

GET/workflows/definitions/{id}/context-schema

Get the per-step context ledger

Computes what context paths are available at each step of the workflow definition, with type, presence (always/maybe), and producer source. Presence degrades to "maybe" at joins unless the entry arrives on every incoming route. Use ?stepId=<id> to narrow the response to one step.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	UUID for DB definitions, or "code:<workflowId>" for code-based definitions
stepId	query	No	any	Narrow the response to this step (404 when the step does not exist)

Responses

200Per-step context ledger

Content-Type: application/json

{
  "steps": {
    "approve": {
      "entries": [
        {
          "path": "orderId",
          "type": "text",
          "presence": "always",
          "source": {
            "kind": "contextSchema",
            "label": "contextSchema.input"
          }
        },
        {
          "path": "discount",
          "type": "number",
          "presence": "maybe",
          "source": {
            "kind": "userTask",
            "stepId": "review",
            "label": "userTask:review"
          }
        }
      ]
    }
  }
}

400Missing tenant context

Content-Type: application/json

{
  "error": "string"
}

403Insufficient permissions

Content-Type: application/json

{
  "error": "string"
}

404Workflow definition or requested step not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/workflows/definitions/string/context-schema" \
  -H "Accept: application/json"

POST/workflows/definitions/{id}/customize

Customize code-based workflow definition

Creates a DB override for a code-based workflow definition, seeded from the current code registry values. The id param must be of the form "code:<workflowId>".

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	Must be of the form "code:<workflowId>"

Responses

200Workflow definition customized successfully

Content-Type: application/json

{
  "data": {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "workflowId": "workflows.simple-approval",
    "workflowName": "Simple Approval Workflow",
    "source": "code_override"
  },
  "message": "Workflow definition customized successfully"
}

400Not a code-based id

Content-Type: application/json

{
  "error": "Customize is only supported for code-based workflow definitions"
}

404Code workflow not found

Content-Type: application/json

{
  "error": "Workflow definition not found"
}

Example

curl -X POST "https://hr.office.dac.systems/api/workflows/definitions/string/customize" \
  -H "Accept: application/json"

GET/workflows/definitions/{id}/draft

Get the current user's draft

Returns the authenticated user's autosaved draft for the workflow definition. Drafts are private to the user who saved them.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	Workflow definition UUID (server drafts exist only for saved definitions)

Responses

200Draft found

Content-Type: application/json

{
  "data": {
    "id": "string",
    "definitionId": null,
    "definition": {
      "steps": [
        {}
      ],
      "transitions": [
        {}
      ]
    },
    "metadata": null,
    "baseUpdatedAt": null,
    "createdAt": null,
    "updatedAt": null
  }
}

400Invalid definition id (only saved definitions have server drafts)

Content-Type: application/json

{
  "error": "string"
}

403Insufficient permissions

Content-Type: application/json

{
  "error": "string"
}

404No draft exists for this user and definition

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/workflows/definitions/string/draft" \
  -H "Accept: application/json"

PUT/workflows/definitions/{id}/draft

Save the current user's draft

Creates or updates the authenticated user's draft for the workflow definition. The definition payload is validated shape-only (steps and transitions must be arrays of objects) so a mid-edit, structurally incomplete graph still saves; full validation runs when the draft is promoted via the definition PUT. Draft saves never participate in the definition's optimistic lock.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	Workflow definition UUID (server drafts exist only for saved definitions)

Request body (application/json)

{
  "definition": {
    "steps": [
      {
        "stepId": "start",
        "stepName": "Start",
        "stepType": "START"
      }
    ],
    "transitions": []
  },
  "baseUpdatedAt": "2026-07-27T10:00:00.000Z"
}

Responses

200Draft saved

Content-Type: application/json

{
  "data": {
    "id": "string",
    "definitionId": null,
    "definition": {
      "steps": [
        {}
      ],
      "transitions": [
        {}
      ]
    },
    "metadata": null,
    "baseUpdatedAt": null,
    "createdAt": null,
    "updatedAt": null
  },
  "message": "string"
}

400Malformed draft payload or invalid definition id

Content-Type: application/json

{
  "error": "string"
}

403Insufficient permissions

Content-Type: application/json

{
  "error": "string"
}

404Workflow definition not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X PUT "https://hr.office.dac.systems/api/workflows/definitions/string/draft" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "{
  \"definition\": {
    \"steps\": [
      {}
    ],
    \"transitions\": [
      {}
    ]
  },
  \"metadata\": null,
  \"baseUpdatedAt\": null
}"

DELETE/workflows/definitions/{id}/draft

Discard the current user's draft

Deletes the authenticated user's draft for the workflow definition. Idempotent: discarding a non-existent draft succeeds.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	Workflow definition UUID (server drafts exist only for saved definitions)

Responses

200Draft discarded (or no draft existed)

Content-Type: application/json

{
  "message": "string"
}

400Invalid definition id

Content-Type: application/json

{
  "error": "string"
}

403Insufficient permissions

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X DELETE "https://hr.office.dac.systems/api/workflows/definitions/string/draft" \
  -H "Accept: application/json"

POST/workflows/definitions/{id}/publish

Publish a new workflow definition version

Mints a frozen published version snapshotting the definition and its IO port contract. Returns affected sub-workflow callers; pass acknowledgeBreakingChanges=true to publish despite breaking changes.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	Workflow definition id

Request body (application/json)

"string"

Responses

200Published

Content-Type: application/json

{
  "data": {
    "id": "…",
    "workflowId": "verify-policy",
    "version": 2,
    "lifecycle": "published"
  },
  "breakingChanges": [],
  "message": "Workflow definition published successfully"
}

404Not found

Content-Type: application/json

{
  "error": "Workflow definition not found"
}

409Breaking changes not acknowledged

Content-Type: application/json

{
  "error": "Publishing would break existing sub-workflow mappings",
  "breakingChanges": [
    {
      "workflowId": "order-flow",
      "version": 1,
      "stepId": "sub",
      "brokenMappings": [
        "input:orderId"
      ]
    }
  ]
}

Example

curl -X POST "https://hr.office.dac.systems/api/workflows/definitions/string/publish" \
  -H "Accept: application/json"

POST/workflows/definitions/{id}/reset-to-code

Reset workflow definition to code version

Deletes the DB override for a code-based workflow definition, reverting it to the original code registry version. Cannot be reset if there are active instances.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	—

Responses

200Workflow definition reset to code version

Content-Type: application/json

{
  "data": {
    "id": "code:checkout-flow",
    "workflowId": "checkout-flow",
    "workflowName": "Checkout Flow",
    "description": "Code-defined checkout workflow",
    "version": 1,
    "source": "code",
    "isCodeBased": true
  },
  "message": "Workflow definition reset to code version"
}

400Definition is not a code-based override

Content-Type: application/json

{
  "error": "This workflow definition is not a code-based override and cannot be reset"
}

404Workflow definition not found

Content-Type: application/json

{
  "error": "Workflow definition not found"
}

409Cannot reset - active workflow instances exist

Content-Type: application/json

{
  "error": "Cannot reset workflow definition with 3 active instance(s)"
}

Example

curl -X POST "https://hr.office.dac.systems/api/workflows/definitions/00000000-0000-4000-8000-000000000000/reset-to-code" \
  -H "Accept: application/json"

POST/workflows/definitions/{id}/test-step

Dry-run one activity config with mock-first semantics

Interpolates the supplied activity config against the sample context (plus a synthetic workflow scope and the server env allowlist) and runs the activity type's would-do mock. Never executes the real activity. Activity types that declare no mock or opt out with "refuse" respond 200 with a structured refusal the editor renders.

Parameters

Name	In	Required	Schema	Description
id	path	Yes	any	UUID for DB definitions, or "code:<workflowId>" for code-based definitions

Request body (application/json)

{
  "stepId": "notify",
  "activityType": "SEND_EMAIL",
  "config": {
    "to": "{{context.customerEmail}}",
    "subject": "Order {{context.orderId}} approved"
  },
  "context": {
    "customerEmail": "jane@example.com",
    "orderId": "ORD-42"
  }
}

Responses

200Simulated mock output, or a structured refusal when the type cannot be simulated

Content-Type: application/json

{
  "simulated": true,
  "activityType": "SEND_EMAIL",
  "output": {
    "sent": false,
    "simulated": true,
    "wouldSendTo": "jane@example.com",
    "subject": "Order ORD-42 approved"
  },
  "interpolatedConfig": {
    "to": "jane@example.com",
    "subject": "Order ORD-42 approved"
  }
}

400Missing tenant context or malformed payload

Content-Type: application/json

{
  "error": "string"
}

403Insufficient permissions

Content-Type: application/json

{
  "error": "string"
}

404Workflow definition or activity type not found

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/workflows/definitions/string/test-step" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "{
  \"activityType\": \"string\",
  \"config\": {}
}"

POST/workflows/definitions/generate

Author a draft workflow definition from natural language

Runs the propose-only workflows.workflow_author agent against this installation's activity, command, function and event catalogs and returns a draft definition plus the Problems-panel evaluation for it. Persists nothing: the draft is returned to the Studio for a human to apply, save and enable. Refusals ("unavailable" when no AI provider or agent registry is present, "failed" when the model call errored, "malformedResponse"/"schemaError" when the output is not a workflow definition) respond 200 with a structured body.

Request body (application/json)

{
  "prompt": "string"
}

Responses

200The generated draft with its Problems-panel evaluation, or a structured refusal

Content-Type: application/json

{
  "ok": true
}

400Invalid request body

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Insufficient permissions

Content-Type: application/json

{
  "error": "string"
}

500Generation failed unexpectedly

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X POST "https://hr.office.dac.systems/api/workflows/definitions/generate" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "{
  \"prompt\": \"string\"
}"

GET/workflows/endpoints

List endpoints available to CALL_API activities

Returns a trimmed projection of the OpenAPI surface (path, method, summary, tag, parameters, and declared request/response schemas) consumed by the CALL_API endpoint picker. Endpoints outside this catalog can still be authored as free text. Responses without a declared schema omit responseSchema so consumers degrade to unknown typing.

Responses

200Endpoint catalog projected from the OpenAPI surface

Content-Type: application/json

{
  "items": [
    {
      "path": "string",
      "method": "string",
      "summary": "string",
      "tag": "string",
      "params": [
        {
          "name": "string",
          "in": "path",
          "required": true,
          "type": "string"
        }
      ],
      "hasRequestSchema": true
    }
  ]
}

400Missing tenant context

Content-Type: application/json

{
  "error": "string"
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Insufficient permissions

Content-Type: application/json

{
  "error": "string"
}

500Internal server error

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/workflows/endpoints" \
  -H "Accept: application/json"

GET/workflows/events

List all workflow events

Get a paginated list of all workflow events with filtering options

Parameters

Name	In	Required	Schema	Description
page	query	No	any	—
pageSize	query	No	any	—
eventType	query	No	any	—
workflowInstanceId	query	No	any	—
userId	query	No	any	—
occurredAtFrom	query	No	any	—
occurredAtTo	query	No	any	—
sortField	query	No	any	—
sortDir	query	No	any	—

Responses

200List of workflow events

Content-Type: application/json

{
  "items": [
    {
      "id": "string",
      "workflowInstanceId": "00000000-0000-4000-8000-000000000000",
      "stepInstanceId": null,
      "eventType": "string",
      "occurredAt": "string",
      "userId": null,
      "workflowInstance": null
    }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 1,
  "totalPages": 1
}

401Unauthorized

Content-Type: application/json

{
  "error": "string"
}

403Insufficient permissions

Content-Type: application/json

{
  "error": "string"
}

500Internal server error

Content-Type: application/json

{
  "error": "string"
}

Example

curl -X GET "https://hr.office.dac.systems/api/workflows/events?page=1&pageSize=50&sortField=occurredAt&sortDir=desc" \
  -H "Accept: application/json"