Mensen: verlof, contracten, portaal

Medewerkers in plaats van klantcontacten: verlofsaldi en aanvragen, dienstverbanden en werkroosters, en de inlog waarmee een klant meekijkt.

59 endpoints, verdeeld over 3 groepen. Een recht geschreven als module.resource.action:own heeft een bereik: :own dekt rijen die van jou zijn, :any die van iedereen, en :any voldoet aan een controle op :own.

`leave`

Endpoint	Recht
`GET` `/leave/availability`	`leave.availability.read`
`POST` `/leave/availability`	`leave.availability.write`
`PATCH` `/leave/availability/{entry_id}`	`leave.availability.write`
`DELETE` `/leave/availability/{entry_id}`	`leave.availability.write`
`GET` `/leave/availability/days`	`leave.availability.read`
`POST` `/leave/availability/move`	`leave.availability.write`
`GET` `/leave/balance`	`leave.request.read`
`GET` `/leave/balance/groups`	`leave.request.read`
`GET` `/leave/contracts`	`leave.request.read`
`POST` `/leave/contracts`	`leave.profile.manage`
`PATCH` `/leave/contracts/{contract_id}`	`leave.profile.manage`
`DELETE` `/leave/contracts/{contract_id}`	`leave.profile.manage`
`GET` `/leave/entitlements`	`leave.entitlement.read`
`PUT` `/leave/entitlements`	`leave.entitlement.write`
`DELETE` `/leave/entitlements`	`leave.entitlement.write`
`POST` `/leave/entitlements/generate`	`leave.entitlement.write`
`GET` `/leave/free-time`	`leave.request.read`
`POST` `/leave/free-time/withdraw`	`leave.request.write`
`GET` `/leave/holidays`	`leave.request.read`
`POST` `/leave/holidays`	`leave.holiday.write`
`PATCH` `/leave/holidays/{holiday_id}`	`leave.holiday.write`
`DELETE` `/leave/holidays/{holiday_id}`	`leave.holiday.write`
`POST` `/leave/holidays/import`	`leave.holiday.write`
`GET` `/leave/profile`	`leave.request.read`
`GET` `/leave/profiles`	`leave.profile.manage`
`PUT` `/leave/profiles/{user_id}`	`leave.profile.manage`
`GET` `/leave/rate`	`leave.rate.read`
`GET` `/leave/rate/{user_id}`	`leave.rate.read`
`PUT` `/leave/rate/{user_id}`	`leave.rate.write`
`GET` `/leave/rates`	`leave.rate.read`
`GET` `/leave/recurring`	`leave.request.read`
`POST` `/leave/recurring`	`leave.request.write`
`PATCH` `/leave/recurring/{recurring_id}`	`leave.request.write`
`DELETE` `/leave/recurring/{recurring_id}`	`leave.request.write`
`GET` `/leave/requests`	`leave.request.read`
`POST` `/leave/requests`	`leave.request.write`
`GET` `/leave/requests/{request_id}`	`leave.request.read`
`PATCH` `/leave/requests/{request_id}`	`leave.request.write`
`POST` `/leave/requests/{request_id}/cancel`	`leave.request.write`
`POST` `/leave/requests/{request_id}/decide`	`leave.request.approve`
`POST` `/leave/requests/preview`	`leave.request.read`
`GET` `/leave/settings`	`leave.profile.manage`
`PUT` `/leave/settings`	`leave.profile.manage`
`GET` `/leave/summary`	`leave.request.read`
`GET` `/leave/team`	`leave.request.read`
`GET` `/leave/types`	`leave.request.read`
`POST` `/leave/types`	`leave.type.write`
`PATCH` `/leave/types/{type_id}`	`leave.type.write`
`DELETE` `/leave/types/{type_id}`	`leave.type.write`

Parameters en schema’s per endpoint

`GET /api/v1/leave/availability`

List Availability — The exception rows with an occurrence in the window — own, or anyone’s with :any.

Recht: leave.availability.read

Queryparameters:

Naam	Type	Betekenis
`date_from`	string · verplicht
`date_to`	string · verplicht
`user_id`	string
`all_users`	boolean	(default `false`)

Antwoord: 200 · AvailabilityRead[]

`POST /api/v1/leave/availability`

Create Availability

Recht: leave.availability.write

Request body: AvailabilityCreate

Antwoord: 201 · AvailabilityRead

`PATCH /api/v1/leave/availability/{entry_id}`

Update Availability

Recht: leave.availability.write

Padparameters: entry_id

Request body: AvailabilityUpdate

Antwoord: 200 · AvailabilityRead

`DELETE /api/v1/leave/availability/{entry_id}`

Delete Availability — Deletes the other half too when the row is a move — see the service.

Recht: leave.availability.write

Padparameters: entry_id

Antwoord: 204

`GET /api/v1/leave/availability/days`

Availability Days — The resolved week: the base schedule with every exception applied, day by day.

Recht: leave.availability.read

Queryparameters:

Naam	Type	Betekenis
`date_from`	string · verplicht
`date_to`	string · verplicht
`user_id`	string
`all_users`	boolean	(default `false`)

Antwoord: 200 · AvailabilityDay[]

`POST /api/v1/leave/availability/move`

Move Availability — Swap one day for another — two rows sharing a pair_id, written in one act.

Recht: leave.availability.write

Request body: AvailabilityMove

Antwoord: 201 · AvailabilityRead[]

`GET /api/v1/leave/balance`

Balances

Recht: leave.request.read

Queryparameters:

Naam	Type	Betekenis
`year`	integer · verplicht
`user_id`	string

Antwoord: 200 · LeaveBalance[]

`GET /api/v1/leave/balance/groups`

Group Balances — The employee-facing combined balances (#265): one figure per balance group (statutory + extra-statutory vacation roll up into one “Vakantieverlof”), with the per-pot breakdown — accrual year, remaining, expiry — alongside for anyone who needs to see where hours went.

Recht: leave.request.read

Queryparameters:

Naam	Type	Betekenis
`year`	integer · verplicht
`user_id`	string
`all_users`	boolean	(default `false`)

Antwoord: 200 · LeaveGroupBalance[]

`GET /api/v1/leave/contracts`

List Contracts — A user’s employment history. Own for a member; anyone’s — or everyone’s, with all_users — for a manager (the Settings → Users roster).

Recht: leave.request.read

Queryparameters:

Naam	Type	Betekenis
`user_id`	string
`all_users`	boolean	(default `false`)

Antwoord: 200 · EmploymentContractRead[]

`POST /api/v1/leave/contracts`

Create Contract

Recht: leave.profile.manage

Request body: EmploymentContractCreate

Antwoord: 201 · EmploymentContractRead

`PATCH /api/v1/leave/contracts/{contract_id}`

Update Contract

Recht: leave.profile.manage

Padparameters: contract_id

Request body: EmploymentContractUpdate

Antwoord: 200 · EmploymentContractRead

`DELETE /api/v1/leave/contracts/{contract_id}`

Delete Contract

Recht: leave.profile.manage

Padparameters: contract_id

Antwoord: 204

`GET /api/v1/leave/entitlements`

List Entitlements — Own entitlements; managers see everyone’s when no user_id is given.

Recht: leave.entitlement.read

Queryparameters:

Naam	Type	Betekenis
`year`	integer · verplicht
`user_id`	string

Antwoord: 200 · LeaveEntitlementRead[]

`PUT /api/v1/leave/entitlements`

Upsert Entitlement

Recht: leave.entitlement.write

Request body: LeaveEntitlementUpsert

Antwoord: 200 · LeaveEntitlementRead

`DELETE /api/v1/leave/entitlements`

Delete Entitlement — Drop a pot and let generation re-derive it — the revert behind “clear it to let it be derived again”. A current/next-year pot reappears with the derived figure in the same request; a past year’s simply goes (history is never backfilled).

Recht: leave.entitlement.write

Queryparameters:

Naam	Type	Betekenis
`year`	integer · verplicht
`user_id`	string · verplicht
`leave_type_id`	string · verplicht

Antwoord: 204

`POST /api/v1/leave/entitlements/generate`

Generate Entitlements

Recht: leave.entitlement.write

Request body: EntitlementGenerate

Antwoord: 200 · GenerateResult

`GET /api/v1/leave/free-time`

Free Time Overview — Everything the free-time card and the employment wizard need, in one call.

Recht: leave.request.read

Queryparameters:

Naam	Type	Betekenis
`year`	integer · verplicht
`user_id`	string

Antwoord: 200 · FreeTimeOverview

`POST /api/v1/leave/free-time/withdraw`

Withdraw Free Time — Take back free days the pot no longer covers, after a contract change reprorated it (#264).

Recht: leave.request.write

Request body: FreeTimeWithdraw

Antwoord: 200 · FreeTimeWithdrawResult

`GET /api/v1/leave/holidays`

List Holidays — The org’s calendar. Any staff member: it drives the agenda and the timesheet.

Recht: leave.request.read

Queryparameters:

Naam	Type	Betekenis
`year`	integer
`date_from`	string
`date_to`	string
`include_inactive`	boolean	(default `false`)

Antwoord: 200 · LeaveHolidayRead[]

`POST /api/v1/leave/holidays`

Create Holiday

Recht: leave.holiday.write

Request body: LeaveHolidayCreate

Antwoord: 201 · LeaveHolidayRead

`PATCH /api/v1/leave/holidays/{holiday_id}`

Update Holiday

Recht: leave.holiday.write

Padparameters: holiday_id

Request body: LeaveHolidayUpdate

Antwoord: 200 · LeaveHolidayRead

`DELETE /api/v1/leave/holidays/{holiday_id}`

Delete Holiday

Recht: leave.holiday.write

Padparameters: holiday_id

Antwoord: 204

`POST /api/v1/leave/holidays/import`

Import Holidays — Re-run the generator for a year. Manual and deactivated rows survive untouched.

Recht: leave.holiday.write

Request body: HolidayImport

Antwoord: 200 · HolidayImportResult

`GET /api/v1/leave/profile`

My Profile — The caller’s effective schedule — merged server-side, on purpose (#46).

Recht: leave.request.read

Antwoord: 200 · LeaveProfileRead

`GET /api/v1/leave/profiles`

List Profiles — Contract hours + own schedule per user (managers). A null schedule follows the org’s.

Recht: leave.profile.manage

Antwoord: 200 · LeaveProfileSummary[]

`PUT /api/v1/leave/profiles/{user_id}`

Set Profile

Recht: leave.profile.manage

Padparameters: user_id

Request body: LeaveProfileUpdate

Antwoord: 200 · LeaveProfileSummary

`GET /api/v1/leave/rate`

My Rate — The caller’s own hourly rate (salary-adjacent — a member sees only their own).

Recht: leave.rate.read

Antwoord: 200 · LeaveRateRead

`GET /api/v1/leave/rate/{user_id}`

User Rate — One employee’s rate. Own on :own; anyone’s on :any.

Recht: leave.rate.read

Padparameters: user_id

Antwoord: 200 · LeaveRateRead

`PUT /api/v1/leave/rate/{user_id}`

Set Rate — Set or clear an employee’s rate (admin). Attributed nowhere — the rate is current state.

Recht: leave.rate.write

Padparameters: user_id

Request body: LeaveRateUpdate

Antwoord: 200 · LeaveRateRead

`GET /api/v1/leave/rates`

List Rates — Every employee’s rate for the managers’ roster. Requires leave.rate.read:any.

Recht: leave.rate.read

Antwoord: 200 · LeaveRateRead[]

`GET /api/v1/leave/recurring`

List Recurring — Rostered-free-day patterns: a member’s own; anyone’s/all on leave.profile.manage.

Recht: leave.request.read

Queryparameters:

Naam	Type	Betekenis
`user_id`	string

Antwoord: 200 · LeaveRecurringDayRead[]

`POST /api/v1/leave/recurring`

Create Recurring — A manager plans any type for anyone; a member plans their own self-service types (requires_approval = false) — the service enforces the split.

Recht: leave.request.write

Request body: LeaveRecurringDayCreate

Antwoord: 201 · LeaveRecurringDaySaved

`PATCH /api/v1/leave/recurring/{recurring_id}`

Update Recurring

Recht: leave.request.write

Padparameters: recurring_id

Request body: LeaveRecurringDayUpdate

Antwoord: 200 · LeaveRecurringDaySaved

`DELETE /api/v1/leave/recurring/{recurring_id}`

Delete Recurring — Delete the pattern. By default the days it placed stay — they are real leave somebody planned around, and a rule being removed is no reason to wipe a calendar.

Recht: leave.request.write

Padparameters: recurring_id

Queryparameters:

Naam	Type	Betekenis
`withdraw_days`	boolean	(default `false`)

Antwoord: 200 · LeaveRecurringDeleteResult

`GET /api/v1/leave/requests`

List Requests

Recht: leave.request.read

Queryparameters:

Naam	Type	Betekenis
`limit`	integer	(default `50`)
`offset`	integer	(default `0`)
`user_id`	string
`all_users`	boolean	(default `false`)
`year`	integer
`status`	LeaveRequestStatus
`sort`	string	employee \| start_date \| end_date \| hours \| status, ’-’ desc

Antwoord: 200 · Page_LeaveRequestRead_

`POST /api/v1/leave/requests`

Create Request

Recht: leave.request.write

Request body: LeaveRequestCreate

Antwoord: 201 · LeaveRequestRead

`GET /api/v1/leave/requests/{request_id}`

Get Request

Recht: leave.request.read

Padparameters: request_id

Antwoord: 200 · LeaveRequestRead

`PATCH /api/v1/leave/requests/{request_id}`

Update Request

Recht: leave.request.write

Padparameters: request_id

Request body: LeaveRequestUpdate

Antwoord: 200 · LeaveRequestRead

`POST /api/v1/leave/requests/{request_id}/cancel`

Cancel Request

Recht: leave.request.write

Padparameters: request_id

Antwoord: 200 · LeaveRequestRead

`POST /api/v1/leave/requests/{request_id}/decide`

Decide Request — Approve or reject a pending request (managers).

Recht: leave.request.approve

Padparameters: request_id

Request body: LeaveRequestDecision

Antwoord: 200 · LeaveRequestRead

`POST /api/v1/leave/requests/preview`

Preview Request — What a span costs, before it is submitted — so the number shown is the number stored.

Recht: leave.request.read

Request body: LeaveRequestPreview

Antwoord: 200 · LeavePreviewResult

`GET /api/v1/leave/settings`

Get Settings — The org’s leave settings. An org that never saved a row gets the defaults.

Recht: leave.profile.manage

Antwoord: 200 · LeaveSettingsRead

`PUT /api/v1/leave/settings`

Update Settings

Recht: leave.profile.manage

Request body: LeaveSettingsUpdate

Antwoord: 200 · LeaveSettingsRead

`GET /api/v1/leave/summary`

Summary

Recht: leave.request.read

Antwoord: 200 · LeaveSummary

`GET /api/v1/leave/team`

Team

Recht: leave.request.read

Queryparameters:

Naam	Type	Betekenis
`date_from`	string · verplicht
`date_to`	string · verplicht
`user_id`	string

Antwoord: 200 · TeamLeaveItem[]

`GET /api/v1/leave/types`

List Types

Recht: leave.request.read

Queryparameters:

Naam	Type	Betekenis
`include_inactive`	boolean	(default `false`)

Antwoord: 200 · LeaveTypeRead[]

`POST /api/v1/leave/types`

Create Type

Recht: leave.type.write

Request body: LeaveTypeCreate

Antwoord: 201 · LeaveTypeRead

`PATCH /api/v1/leave/types/{type_id}`

Update Type

Recht: leave.type.write

Padparameters: type_id

Request body: LeaveTypeUpdate

Antwoord: 200 · LeaveTypeRead

`DELETE /api/v1/leave/types/{type_id}`

Delete Type

Recht: leave.type.write

Padparameters: type_id

Antwoord: 204

`hr`

Endpoint	Recht
`POST` `/hr/documents`	`hr.document.manage`
`DELETE` `/hr/documents/{document_id}`	`hr.document.manage`
`GET` `/hr/documents/{document_id}/file`	`hr.dossier.read`
`GET` `/hr/dossier`	`hr.dossier.read`

Parameters en schema’s per endpoint

`POST /api/v1/hr/documents`

Upload Document

Recht: hr.document.manage

Queryparameters:

Naam	Type	Betekenis
`user_id`	string · verplicht
`category`	string · verplicht
`title`	string	(default “)
`note`	string	(default “)

Request body: Body_upload_document_api_v1_hr_documents_post

Antwoord: 201 · HrDocumentRead

`DELETE /api/v1/hr/documents/{document_id}`

Delete Document

Recht: hr.document.manage

Padparameters: document_id

Antwoord: 204

`GET /api/v1/hr/documents/{document_id}/file`

Serve Document

Recht: hr.dossier.read

Padparameters: document_id

Antwoord: 200

`GET /api/v1/hr/dossier`

Dossier

Recht: hr.dossier.read

Queryparameters:

Naam	Type	Betekenis
`user_id`	string

Antwoord: 200 · DossierRead

`portal`

Endpoint	Recht
`POST` `/portal/impersonation/stop`	Bewust open
`GET` `/portal/logins/{entity_type}/{subject_id}`	`members.member.write`
`POST` `/portal/logins/{entity_type}/{subject_id}`	`members.member.write`
`DELETE` `/portal/logins/{entity_type}/{subject_id}`	`members.member.write`
`POST` `/portal/logins/{entity_type}/{subject_id}/impersonate`	`portal.login.impersonate`
`POST` `/portal/logins/{entity_type}/{subject_id}/resend`	`members.member.write`

Parameters en schema’s per endpoint

`POST /api/v1/portal/impersonation/stop`

Stop Portal Impersonation

Recht: Bewust open

Antwoord: 204