Document API

Manages companion (pet) documents: upload URLs, create, list, update, view/download, search, and delete. Routes under /mobile are called by the mobile app (pet parents); routes under /pms are called by the PIMS (Practice Information Management System, the clinic-facing web app) and require organisation RBAC (role-based access control) permissions.

Endpoints

POST /mobile/upload-url

• Auth: requireMobileAuth
• Body: UploadUrlBody
• Body fields: companionId, mimeType
• Controller: DocumentController.getUploadUrl
• Response: 400: keys message, 200: JSON, 500: keys message

POST /mobile/:companionId

• Auth: requireMobileAuth
• Params: companionId
• Body: DocumentRequestBody
• Body fields: title, category, subcategory, attachments, appointmentId, visitType, issuingBusinessName, issueDate
• Controller: DocumentController.createDocument

GET /mobile/:companionId

• Auth: requireMobileAuth
• Params: companionId
• Controller: DocumentController.listDocumentsForParent

PATCH /mobile/details/:id

• Auth: requireMobileAuth
• Params: id
• Body: Partial<DocumentRequestBody
• Controller: DocumentController.updateDocument
• Response: 401: keys message, 400: keys message, 200: keys message, 500: keys message

GET /mobile/appointments/:appointmentId

• Auth: requireMobileAuth
• Params: appointmentId
• Controller: DocumentController.listForAppointment

GET /mobile/view/:documentId

• Auth: requireMobileAuth
• Params: documentId
• Controller: DocumentController.getDocumentDownloadUrl
• Response: 400: keys message, 200: keys message, 500: keys message

POST /mobile/view

• Auth: requireMobileAuth
• Body: SignedDownloadUrlBody
• Body fields: key
• Controller: DocumentController.getSignedDownloadUrl
• Response: 400: keys message, 200: JSON, 500: keys message

DELETE /mobile/:documentId

• Auth: requireMobileAuth
• Params: documentId
• Controller: DocumentController.deleteForParent

GET /search/:companionId

• Auth: requireMobileAuth
• Params: companionId
• Query: title
• Controller: DocumentController.searchDocument
• Response: 400: keys companionId, message, title, 200: keys documents, message, 500: keys message

POST /pms/upload-url

• Auth: requireWebAuth
• RBAC: withOrgPermissions, requirePermission
• Body: UploadUrlBody
• Body fields: companionId, mimeType
• Controller: DocumentController.getUploadUrl
• Response: 400: keys message, 200: JSON, 500: keys message

POST /pms/:companionId

• Auth: requireWebAuth
• RBAC: withOrgPermissions, requirePermission
• Params: companionId
• Body: DocumentRequestBody
• Body fields: title, category, subcategory, attachments, appointmentId, visitType, issuingBusinessName, issueDate
• Controller: DocumentController.createDocumentPms

GET /pms/:companionId

• Auth: requireWebAuth
• RBAC: withOrgPermissions, requirePermission
• Params: companionId
• Controller: DocumentController.listForPms

GET /pms/details/:documentId

• Auth: requireWebAuth
• RBAC: withOrgPermissions, requirePermission
• Params: documentId
• Controller: DocumentController.getForPms

PATCH /pms/details/:documentId

• Auth: requireWebAuth
• RBAC: withOrgPermissions, requirePermission
• Params: documentId
• Body: Partial<DocumentRequestBody
• Controller: DocumentController.updateDocument
• Response: 401: keys message, 400: keys message, 200: keys message, 500: keys message

GET /pms/view/:documentId

• Auth: requireWebAuth
• RBAC: withOrgPermissions, requirePermission
• Params: documentId
• Controller: DocumentController.getDocumentDownloadUrl
• Response: 400: keys message, 200: keys message, 500: keys message

POST /pms/view

• Auth: requireWebAuth
• RBAC: withOrgPermissions, requirePermission
• Body: SignedDownloadUrlBody
• Body fields: key
• Controller: DocumentController.getSignedDownloadUrl
• Response: 400: keys message, 200: JSON, 500: keys message

GET /pms/appointments/:appointmentId

• Auth: requireWebAuth
• RBAC: withOrgPermissions, requirePermission
• Params: appointmentId
• Controller: DocumentController.listForAppointment