Manages clinic inventory: items and batches, stock consumption and adjustments, vendors, custom meta-fields, and low-stock/expiry alerts. Called by the PIMS (Practice Information Management System, the clinic-facing web app); most routes require organisation RBAC (role-based access control) permissions.
Endpoints
POST /items
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Body:
CreateInventoryItemInput - Controller:
InventoryController.createItem - Response:
201: JSON
PATCH /items/:itemId
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
itemId - Body:
UpdateInventoryItemInput - Controller:
InventoryController.updateItem
POST /items/:itemId/hide
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
itemId - Controller:
InventoryController.hideItem
POST /items/:itemId/archive
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
itemId - Controller:
InventoryController.archiveItem
POST /items/:itemId/active
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
itemId - Controller:
InventoryController.activeItem
GET /organisation/:organisationId/items
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
organisationId - Controller:
InventoryController.listItems
GET /organisation/:organisationId/turnover
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
organisationId - Query:
from,to - Controller:
InventoryController.getInventoryTurnOver - Response:
200: keysfrom,items,to,500: keysmessage
GET /items/:itemId
- Auth:
requireWebAuth - RBAC:
requirePermission - Params:
itemId - Controller:
InventoryController.getItemWithBatches
POST /items/:itemId/batches
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
itemId - Body:
InventoryBatchInput - Controller:
InventoryController.addBatch
PATCH /batches/:batchId
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
batchId - Body:
Partial<InventoryBatchInput - Controller:
InventoryController.updateBatch
DELETE /batches/:batchId
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
batchId - Controller:
InventoryController.deleteBatch
POST /stock/consume
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Body:
ConsumeStockInput - Controller:
InventoryController.consumeStock
POST /stock/consume/bulk
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Body:
BulkConsumeStockInput - Controller:
InventoryController.bulkConsumeStock
POST /items/:itemId/adjust
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
itemId - Body:
{ newOnHand: number; reason: string } - Controller:
InventoryController.adjustStock
POST /items/:itemId/allocate
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
itemId - Body:
{ quantity: number; referenceId: string } - Controller:
InventoryController.allocateStock
POST /items/:itemId/release
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
itemId - Body:
{ quantity: number; referenceId: string } - Controller:
InventoryController.releaseAllocatedStock
POST /vendors
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Controller:
InventoryVendorController.createVendor
GET /organisation/:organisationId/vendors
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
organisationId - Controller:
InventoryVendorController.listVendors
GET /vendors/:vendorId
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
vendorId - Controller:
InventoryVendorController.getVendor
PATCH /vendors/:vendorId
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
vendorId - Controller:
InventoryVendorController.updateVendor
DELETE /vendors/:vendorId
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
vendorId - Controller:
InventoryVendorController.deleteVendor
POST /meta-fields
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Controller:
InventoryMetaFieldController.createField
GET /meta-fields
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Controller:
InventoryMetaFieldController.listFields
PATCH /meta-fields/:fieldId
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
fieldId - Controller:
InventoryMetaFieldController.updateField
DELETE /meta-fields/:fieldId
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
fieldId - Controller:
InventoryMetaFieldController.deleteField
GET /organisation/:organisationId/alerts/low-stock
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
organisationId - Controller:
InventoryAlertController.getLowStockItems
GET /organisation/:organisationId/alerts/expiring
- Auth:
requireWebAuth - RBAC:
withOrgPermissions, requirePermission - Params:
organisationId - Controller:
InventoryAlertController.getExpiringItems