medianfi-com Receivables API

openapi: 3.2.0
info:
  title: Median Receivables API
  version: 0.1.0
  description: Production-grade Node.js + Express API starter template
  license:
    name: Proprietary
servers:
- url: /api/v1
security: []
tags:
- name: Receivables
paths:
  /companies/{companyId}/contracts:
    parameters:
    - $ref: '#/components/parameters/companyId'
    - $ref: '#/components/parameters/demoParityCustomerAppSurface'
    - $ref: '#/components/parameters/financialEntityId'
    get:
      operationId: listContracts
      summary: List contracts with funding rollups (attention-first)
      description: DARK — 404s unless ar_ap_items_enabled. Each contract carries a derived `funding` rollup {contractedCents, invoicedToDateCents, remainingCents, pctInvoiced, isFullyInvoiced} computed from its non-void AR items (linkage sourceMetadata.contractId); invariant invoicedToDate + remaining = contracted. Sorted attention-first (remaining > 0 or status overdue), then by contracted value. The envelope also carries totalContractedCents and activeContractCount (active = not cancelled/completed), plus currency and minorUnitExponent. Funding rollups carry the same non-null currency authority. Mixed, invalid, missing, or non-two-decimal source currencies fail with MONETARY_AGGREGATE_CURRENCY_UNAVAILABLE (422).
      tags:
      - Receivables
      security:
      - bearerAuth: []
      parameters:
      - name: status
        in: query
        schema:
          type: string
          enum:
          - new
          - on_track
          - overdue
          - completed
          - cancelled
      - name: customerId
        in: query
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: '{ contracts: [contract + funding], totalContractedCents, activeContractCount, currency, minorUnitExponent }'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          description: AR/AP items not enabled for this company
        '422':
          description: Validation error or unavailable homogeneous two-decimal currency authority
    post:
      operationId: createContract
      summary: Create a contract (the contract-to-cash funding target)
      description: DARK — 404s unless ar_ap_items_enabled. customerId (when given) must belong to the company — validated via the company-scoped customer lookup; customerName denormalizes from the master record when omitted. invoiced_to_date is never stored; funding derives on read.
      tags:
      - Receivables
      security:
      - bearerAuth: []
      responses:
        '201':
          description: Contract created (with funding rollup)
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          description: Customer not found or AR/AP not enabled
        '422':
          description: Validation error
  /companies/{companyId}/contracts/{contractId}:
    parameters:
    - $ref: '#/components/parameters/companyId'
    - name: contractId
      in: path
      required: true
      schema:
        type: string
        format: uuid
    - $ref: '#/components/parameters/demoParityCustomerAppSurface'
    - $ref: '#/components/parameters/financialEntityId'
    get:
      operationId: getContract
      summary: Contract detail with funding and its invoices
      tags:
      - Receivables
      security:
      - bearerAuth: []
      responses:
        '200':
          description: Contract + funding + invoices (AR items linked via sourceMetadata.contractId)
        '404':
          description: Not found or AR/AP not enabled
    patch:
      operationId: patchContract
      summary: Edit contract header/status fields (CRUD-lite)
      tags:
      - Receivables
      security:
      - bearerAuth: []
      responses:
        '200':
          description: Contract updated (with funding rollup)
        '404':
          description: Not found or AR/AP not enabled
        '422':
          description: Validation error
  /companies/{companyId}/receivables/summary:
    parameters:
    - $ref: '#/components/parameters/companyId'
    - $ref: '#/components/parameters/demoParityCustomerAppSurface'
    - $ref: '#/components/parameters/financialEntityId'
    get:
      operationId: getReceivablesSummary
      summary: Receivables summary cards (overdue / dueSoon / current / outstanding)
      description: DARK — 404s unless ar_ap_items_enabled. Each figure is {amountCents, count} over OUTSTANDING balances (amount - paid) of items whose status is not paid/void/uncollectible. overdue = past due; dueSoon = due within 7 days; current = outstanding - overdue (identity holds for both amount and count). The aggregate carries currency and minorUnitExponent; an empty zero-value aggregate carries null/null rather than a guessed currency.
      tags:
      - Receivables
      security:
      - bearerAuth: []
      responses:
        '200':
          description: '{ overdue, dueSoon, current, outstanding, currency, minorUnitExponent }; figures are { amountCents, count }'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          description: AR/AP items not enabled for this company
        '422':
          description: MONETARY_AGGREGATE_CURRENCY_UNAVAILABLE for mixed, invalid, missing, or non-two-decimal currency authority
  /companies/{companyId}/receivables/pipeline:
    parameters:
    - $ref: '#/components/parameters/companyId'
    - $ref: '#/components/parameters/demoParityCustomerAppSurface'
    - $ref: '#/components/parameters/financialEntityId'
    get:
      operationId: getReceivablesPipeline
      summary: Contract-to-cash pipeline (last / this / next month)
      description: 'DARK — 404s unless ar_ap_items_enabled. months[3] each {key: YYYY-MM, label, contractedCents (active contracts'' billable that month from cadence + per_invoice_cents), invoicedCents (non-void AR items issued that month), collectedCents (ar_item_payments in the month)}; plus totals across the three months, activeContractCount and totalContractedCents. The envelope carries currency and minorUnitExponent (null/null only when every returned monetary aggregate is empty).'
      tags:
      - Receivables
      security:
      - bearerAuth: []
      responses:
        '200':
          description: '{ months[3], totals, activeContractCount, totalContractedCents, currency, minorUnitExponent }'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          description: AR/AP items not enabled for this company
        '422':
          description: MONETARY_AGGREGATE_CURRENCY_UNAVAILABLE for mixed, invalid, missing, or non-two-decimal currency authority
  /companies/{companyId}/receivables/pipeline/periods:
    parameters:
    - $ref: '#/components/parameters/companyId'
    - $ref: '#/components/parameters/demoParityCustomerAppSurface'
    - $ref: '#/components/parameters/financialEntityId'
    get:
      operationId: listReceivablesPipelinePeriods
      summary: Period-explorer months (default 11 back through 1 ahead)
      tags:
      - Receivables
      security:
      - bearerAuth: []
      parameters:
      - name: from
        in: query
        schema:
          type: string
          pattern: ^\d{4}-(0[1-9]|1[0-2])$
      - name: to
        in: query
        schema:
          type: string
          pattern: ^\d{4}-(0[1-9]|1[0-2])$
      responses:
        '200':
          description: '{ from, to, periods: [{ key, label, monthIdx (0-based), year, isCurrent, isFuture, contractedCents, invoicedCents, collectedCents, contractCount }], currency, minorUnitExponent }'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          description: AR/AP items not enabled for this company
        '422':
          description: Invalid range or unavailable homogeneous two-decimal currency authority
  /companies/{companyId}/receivables/pipeline/periods/{periodKey}:
    parameters:
    - $ref: '#/components/parameters/companyId'
    - name: periodKey
      in: path
      required: true
      schema:
        type: string
        pattern: ^\d{4}-(0[1-9]|1[0-2])$
    - $ref: '#/components/parameters/demoParityCustomerAppSurface'
    - $ref: '#/components/parameters/financialEntityId'
    get:
      operationId: getReceivablesPipelinePeriod
      summary: One period's contract rollup + invoices
      description: 'DARK — 404s unless ar_ap_items_enabled. Returns { period, contractRollup: { rows: [{ contract, funding }], remainingCents, openCount }, invoices }. Rows are the contracts billable in the month with their OVERALL funding rollups; invoices are the AR items issued in the month (any status — the explorer filters).'
      tags:
      - Receivables
      security:
      - bearerAuth: []
      responses:
        '200':
          description: '{ period, contractRollup, invoices, currency, minorUnitExponent }'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          description: AR/AP items not enabled for this company
        '422':
          description: Invalid period key or unavailable homogeneous two-decimal currency authority
  /companies/{companyId}/receivables/aging:
    parameters:
    - $ref: '#/components/parameters/companyId'
    - $ref: '#/components/parameters/demoParityCustomerAppSurface'
    - $ref: '#/components/parameters/financialEntityId'
    get:
      operationId: getReceivablesAging
      summary: Interactive AR aging (buckets shared with /reports/ar-aging)
      description: DARK — 404s unless ar_ap_items_enabled. Buckets by due date with the SAME computeBucket boundaries (0/30/60/90 days past due) as the aging report so the two surfaces cannot drift. Amounts are outstanding cents. Items carry invoiceId, invoiceNumber, customerName, dueDate, daysOverdue, totalCents, outstandingCents, amountPaidCents, bucket, source. The aggregate and each item carry currency authority; an empty zero-value aggregate carries currency/minorUnitExponent as null/null.
      tags:
      - Receivables
      security:
      - bearerAuth: []
      parameters:
      - name: asOfDate
        in: query
        schema:
          type: string
          format: date
      responses:
        '200':
          description: '{ asOfDate, grandTotalCents, buckets[5]: { id, label, amountCents, count }, items, currency, minorUnitExponent, unlinkedAccountantEntries? }'
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  data:
                    type: object
                    additionalProperties: true
                    properties:
                      unlinkedAccountantEntries:
                        $ref: '#/components/schemas/UnlinkedAccountantEntries'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          description: AR/AP items not enabled for this company
        '422':
          description: Invalid asOfDate or unavailable homogeneous two-decimal currency authority
  /companies/{companyId}/receivables/payment-settings:
    parameters:
    - $ref: '#/components/parameters/companyId'
    - $ref: '#/components/parameters/demoParityCustomerAppSurface'
    get:
      operationId: getReceivablesPaymentSettings
      summary: Receivables payment settings (enabled methods + live Stripe Connect status)
      description: 'Wave 3b (#1153/#1154) + AR charge rail. DARK — 404s unless ar_ap_items_enabled. Returns the merchant-configurable collection methods (card via Stripe Connect, bank transfer / ACH-wire) plus the LIVE Stripe Connect onboarding status derived from stripe_connections — never a stored connected flag. Shape: { available, feeMode: absorb|pass, methods: { card: { enabled, connected, rail: "stripe_connect" }, bankTransfer: { enabled, detailsStatus: not_provided|pending|provided, instructions } }, bankAccount: { accountHolderName, bankName, routingNumber, accountNumber, accountType, swiftBic, wireInstructions }, stripeConnect: { status, connected, accountId (masked ****1234 or null), livemode, lastSyncAt }, updatedAt }. The bankAccount block is the structured receiving-account detail; the sensitive fields (routingNumber, accountNumber, swiftBic) are ALWAYS masked to ****1234 on read — clear values never leave the API on this surface. The public pay page offers bank transfer only when bankTransfer.enabled AND the four payer-required bankAccount fields (holder, bank, routing, account) are present.'
      tags:
      - Receivables
      security:
      - bearerAuth: []
      responses:
        '200':
          description: ReceivablesPaymentSettingsView
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          description: AR/AP items not enabled for this company
    post:
      operationId: updateReceivablesPaymentSettings
      summary: Update enabled payment methods and bank-transfer details
      description: 'Wave 3b (#1153/#1154) + AR charge rail. DARK — 404s unless ar_ap_items_enabled. Member role required. Merge-patch: send only the fields being changed; a provided null clears a clearable field. Enabling card is refused with 422 STRIPE_CONNECT_NOT_CONNECTED unless a Stripe account is actually linked, and with 422 STRIPE_ACCOUNT_CANNOT_CHARGE when the linked account''s charges_enabled capability is not active (both fail-closed). bankTransfer.detailsStatus is derived: "provided" when instructions are present, else "not_provided". bankAccount fields are stored clear (the public pay page serves them to the payer) but ALWAYS masked ****1234 on the returned view. Returns the updated ReceivablesPaymentSettingsView (see GET for the shape incl. feeMode + bankAccount).'
      tags:
      - Receivables
      security:
      - bearerAuth: []
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              properties:
                card:
                  type: object
                  additionalProperties: false
                  required:
                  - enabled
                  properties:
                    enabled:
                      type: boolean
                feeMode:
                  type: string
                  enum:
                  - absorb
                  - pass
                  description: 'Stored merchant preference for the card processing fee. Display/informational for now: the charge path FORCE-ABSORBS (the payer is charged the principal only) until pass-mode surcharge accounting ships.

                    '
                bankTransfer:
                  type: object
                  additionalProperties: false
                  properties:
                    enabled:
                      type: boolean
                    instructions:
                      type:
                      - string
                      - 'null'
                      maxLength: 2000
                bankAccount:
                  type: object
                  additionalProperties: false
                  description: 'Structured receiving-account details, merged per-field onto the stored row (null clears a field). The public pay page requires accountHolderName + bankName + routingNumber + accountNumber before offering bank transfer.

                    '
                  properties:
                    accountHolderName:
                      type:
                      - string
                      - 'null'
                      maxLength: 200
                    bankName:
                      type:
                      - string
                      - 'null'
                      maxLength: 200
                    routingNumber:
                      type:
                      - string
                      - 'null'
                      maxLength: 64
                    accountNumber:
                      type:
                      - string
                      - 'null'
                      maxLength: 64
                    accountType:
                      type:
                      - string
                      - 'null'
                      enum:
                      - checking
                      - savings
                      - null
                    swiftBic:
                      type:
                      - string
                      - 'null'
                      maxLength: 64
                    wireInstructions:
                      type:
                      - string
                      - 'null'
                      maxLength: 2000
      responses:
        '200':
          description: Updated ReceivablesPaymentSettingsView (feeMode + masked bankAccount included)
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: AR/AP items not enabled for this company
        '422':
          description: STRIPE_CONNECT_NOT_CONNECTED (card enabled without a linked Stripe account), STRIPE_ACCOUNT_CANNOT_CHARGE (linked account cannot charge), or invalid body
  /companies/{companyId}/receivables/payment-settings/stripe-charge:
    parameters:
    - $ref: '#/components/parameters/companyId'
    - $ref: '#/components/parameters/demoParityCustomerAppSurface'
    delete:
      operationId: disableReceivablesStripeChargeRail
      summary: Stop accepting card payments (scoped charge-rail unlink)
      description: 'AR charge rail (D8 / audit #24). DARK — 404s unless ar_ap_items_enabled. Member role required. Turns the card charge rail OFF WITHOUT severing the Stripe integration: clears card_payments_enabled on receivables_payment_settings only. The stripe_connections row — and the transaction archive it anchors — is NEVER deleted or nulled (that would CASCADE the archive away). Bank transfer, the structured bank details, and feeMode are all preserved. Idempotent (a company with card already off is a no-op). Returns the updated ReceivablesPaymentSettingsView (same shape as GET payment-settings), with methods.card.enabled = false and stripeConnect still reporting the intact linkage.'
      tags:
      - Receivables
      security:
      - bearerAuth: []
      responses:
        '200':
          description: Updated ReceivablesPaymentSettingsView (card disabled; Stripe connection untouched)
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: AR/AP items not enabled for this company
  /companies/{companyId}/receivables/stripe-connect/onboarding-link:
    parameters:
    - $ref: '#/components/parameters/companyId'
    - $ref: '#/components/parameters/demoParityCustomerAppSurface'
    post:
      operationId: createReceivablesStripeConnectOnboardingLink
      summary: Hosted Stripe Connect onboarding link for receivables collection
      description: Wave 3b (#1153/#1154). DARK — 404s unless ar_ap_items_enabled. Member role required. Reuses the existing Stripe App install-link plumbing (no hand-rolled Stripe); webhook/callback completion of that flow flips stripe_connections.status, which the next GET payment-settings reflects. Returns { onboardingUrl }. Responds 503 STRIPE_INSTALL_NOT_CONFIGURED when the Stripe install flow is not configured for the environment.
      tags:
      - Receivables
      security:
      - bearerAuth: []
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              properties:
                entityId:
                  type: string
                  format: uuid
      responses:
        '200':
          description: '{ onboardingUrl }'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: AR/AP items not enabled for this company
        '503':
          description: STRIPE_INSTALL_NOT_CONFIGURED — Stripe install flow not configured
  /accountant/companies/{customerId}/receivables/summary:
    parameters:
    - $ref: '#/components/parameters/customerId'
    - $ref: '#/components/parameters/financialEntityId'
    get:
      operationId: accountantGetCustomerReceivablesSummary
      summary: Customer receivables summary (accountant mirror)
      description: 'Accountant-scoped mirror of `GET /companies/{companyId}/receivables/summary`. Same conversion gate as the customer surface (404 unless ar_ap_items_enabled), without the customer-app demo-parity allowlist — parity with the sub-ledgers mirror. Entity scope is resolved from the customer''s own entity roster (accountants hold no per-user entity grants): an explicit `entityId` must be one of the customer''s concrete (non-group) entities; absent, the customer''s single concrete entity is used; a multi-entity customer without `entityId` gets 422 ENTITY_SELECTION_REQUIRED and a customer with no entity gets 422 ENTITY_SCOPE_UNAVAILABLE.'
      tags:
      - Receivables
      security:
      - bearerAuth: []
      - serviceApiKey: []
      responses:
        '200':
          description: 'Same payload as the customer mount: { overdue, dueSoon, current, outstanding, currency, minorUnitExponent }; figures are { amountCents, count }'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: AR/AP items not enabled for this customer
        '422':
          $ref: '#/components/responses/ValidationError'
  /accountant/companies/{customerId}/receivables/pipeline:
    parameters:
    - $ref: '#/components/parameters/customerId'
    - $ref: '#/components/parameters/financialEntityId'
    get:
      operationId: accountantGetCustomerReceivablesPipeline
      summary: Customer contract-to-cash pipeline (accountant mirror)
      description: 'Accountant-scoped mirror of `GET /companies/{companyId}/receivables/pipeline`. Same conversion gate as the customer surface (404 while dark). Entity scope is resolved from the customer''s own entity roster (accountants hold no per-user entity grants): an explicit `entityId` must be one of the customer''s concrete (non-group) entities; absent, the customer''s single concrete entity is used; a multi-entity customer without `entityId` gets 422 ENTITY_SELECTION_REQUIRED and a customer with no entity gets 422 ENTITY_SCOPE_UNAVAILABLE.'
      tags:
      - Receivables
      security:
      - bearerAuth: []
      - serviceApiKey: []
      responses:
        '200':
          description: 'Same payload as the customer mount: months[3] with contracted/invoiced/collected cents + totals'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: AR/AP items not enabled for this customer
        '422':
          $ref: '#/components/responses/ValidationError'
components:
  responses:
    Forbidden:
      description: Insufficient permissions or not a company member
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetail'
    Unauthorized:
      description: Authentication required
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetail'
    ValidationError:
      description: Request failed validation
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetail'
  schemas:
    ProblemDetail:
      type: object
      properties:
        type:
          type: string
        title:
          type: string
          description: 'For application errors, a stable UPPER_SNAKE machine code (for example `NOT_FOUND`, `FORECAST_NOT_FOUND`, `VALIDATION_ERROR`). Clients branch on this, never on `detail` wording. A few transport level responses use a short human title instead.

            '
        status:
          type: integer
        detail:
          type: string
          description: 'Human-readable explanation; correlate a failure with `traceId`. A NOT_FOUND-family 404 names the resource type (for example "Company not found"), not its id. Some legacy messages still include an id (tracked in #2666).

            '
        instance:
          type: string
        traceId:
          type: string
        retryAfter:
          type: integer
          minimum: 0
          description: Whole seconds until retry is allowed for a 429 response
        errors:
          type: array
          items:
            type: object
            properties:
              field:
                type: string
              message:
                type: string
        extensions:
          type: object
          additionalProperties: true
    UnlinkedAccountantEntries:
      type: object
      description: '#1417: posted accountant invoice, bill or payment entries (business-event journal entries on the receivables or payables side of the conversion ownership map) that have no AR/AP item linked to the entry or its event. They are in the general ledger but not in this aging. Present only when the company reads AR/AP from the items tables; absent otherwise. `count` is exact; `items` is capped at 50, newest first.

        '
      required:
      - count
      - items
      properties:
        count:
          type: integer
          minimum: 0
        items:
          type: array
          maxItems: 50
          items:
            $ref: '#/components/schemas/UnlinkedAccountantEntry'
    UnlinkedAccountantEntry:
      type: object
      required:
      - journalEntryId
      - entryDate
      - eventType
      - amountCents
      - currency
      properties:
        journalEntryId:
          type: string
          format: uuid
        entryDate:
          type: string
          format: date
        eventType:
          type: string
          description: Stored business-event type, e.g. vendor_bill
        amountCents:
          type:
          - integer
          - 'null'
          description: Total debits in minor units; null when the entry has no single-currency lines.
        currency:
          type:
          - string
          - 'null'
  parameters:
    financialEntityId:
      name: entityId
      in: query
      description: 'Concrete legal entity that owns this AR/AP request. Omission is accepted only when the actor is authorized to exactly one concrete entity; consolidated scope cannot mutate or serve these entity-only resources.

        '
      schema:
        type: string
        format: uuid
    companyId:
      name: companyId
      in: path
      required: true
      schema:
        type: string
        format: uuid
    demoParityCustomerAppSurface:
      name: X-Median-App-Surface
      in: header
      required: false
      description: 'Optional customer-app bundle marker for production-promoted demo-parity routes. Production customer calls omit this header. When present, qa selects the QA bundle and the server additionally requires an allowlisted test company with persisted client_status=test.

        '
      schema:
        type: string
        const: qa
    customerId:
      name: customerId
      in: path
      required: true
      schema:
        type: string
        format: uuid
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
    serviceApiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: 'Persistent credential for the configured cloud-bookkeeping service principal. The key must carry accountant:* and is accepted only on accountant operations that explicitly list this scheme. Ordinary API keys, and service keys presented to bearer-only operations, are denied.

        '
    refreshSessionCookie:
      type: apiKey
      in: cookie
      name: __Secure-median_refresh
      description: 'Exact production HttpOnly refresh-session cookie. Local non-secure development uses median_refresh.

        '
    passkeyEnrollmentGrantCookie:
      type: apiKey
      in: cookie
      name: __Secure-median_passkey_enrollment
      description: 'Exact production HttpOnly passkey-enrollment grant cookie. Local non-secure development uses median_passkey_enrollment.

        '
    webAuthnCeremonyCookie:
      type: apiKey
      in: cookie
      name: __Secure-median_webauthn
      description: 'Exact production HttpOnly WebAuthn ceremony cookie. Local non-secure development uses median_webauthn.

        '
x-median-quarantined-authorities:
  decision: ADR-0001-model-a
  runtimeStatus: unmounted
  description: 'Migrations 267-272 modeled legal entities as separate company tenants. These paths are not runtime API authority while their preserved accounting math is re-keyed to legal entities inside one company workspace.

    '
  paths:
  - /companies/{companyId}/consolidation-groups
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/report-rollups
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/report-rollups/{rollupId}
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/translation-adjustments
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/translation-adjustments/{adjustmentId}
x-median-demo-parity-customer-surface:
  runtimeStatus: mounted-lifecycle-only
  description: 'v2 customer-app capabilities available to JWT-authenticated members of any active or test company — the v2 app is the product, not a rollout cohort, so no allowlist applies to the markerless path. Production customer calls omit X-Median-App-Surface. Test-company calls may carry X-Median-App-Surface: qa to select the QA bundle; that marker branch alone still requires membership in CUSTOMER_APP_DEMO_PARITY_COMPANY_IDS. An API key, unknown marker, malformed company id, inactive company, missing gate dependency, or failed company lookup receives the standard hidden-resource 404 contract. The held surfaces riding these prefixes (AR/AP, Forecast, Insights) carry their own additional allowlist gate — see x-median-forecast-hold and x-median-ar-ap-hold.

    '
  headerContract: '#/components/parameters/demoParityCustomerAppSurface'
  routePrefixes:
  - /companies/{companyId}/ar
  - /companies/{companyId}/ap
  - /companies/{companyId}/customers
  - /companies/{companyId}/vendors
  - /companies/{companyId}/contracts
  - /companies/{companyId}/receivables
  - /companies/{companyId}/entities
  - /companies/{companyId}/currencies
  - /companies/{companyId}/reporting-scopes
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/rollups
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/translation-adjustments
  - /companies/{companyId}/presentation-report-snapshots
  - /companies/{companyId}/reporting-trial-balances
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/trial-balances
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/intercompany
  - /companies/{companyId}/weekly-email
  - /companies/{companyId}/forecast
  - /companies/{companyId}/books
  - /companies/{companyId}/sub-ledgers
x-median-forecast-hold:
  runtimeStatus: mounted-only-with-server-gate
  description: 'Forecast is held. Beyond the lifecycle-only customer surface above, every operation under the prefix below also requires the company to appear in the held-surface allowlist CUSTOMER_APP_DEMO_PARITY_COMPANY_IDS — the one operator-set list that opens AR/AP, Forecast and Insights (the legacy CUSTOMER_APP_FORECAST_COMPANY_IDS variable is no longer consulted). It is empty by default, so the v2 rollout alone never exposes Forecast. A company off the list receives the same hidden-resource 404 contract as one for which the surface does not exist. The auth-context featureFlags key `forecast` mirrors this verdict for the customer app shell.

    '
  featureFlag: forecast
  routePrefixes:


# --- truncated at 32 KB (36 KB total) ---
# Full source: https://artifacts.apis.io/medianfi-com/openapi/medianfi-com-receivables-api-openapi.yml