Master data API – endpoints, permissions and storage
Parameters, checked permission keys, content scope and written tables of the partner, address master, bank account master and partner bank account endpoints.
Overview
The master data endpoints work through the catalog models company/company and masterdata/bankaccount; a bank account is always brought into canonical form by the central normaliser (dlbtvalidate). The content scope of the partner endpoints is the key owner's group and company rules (getApiScopeGroups(), getApiScopeCompanies()). Every endpoint has an openapi self-description piece.
Endpoints
| Endpoint | Behaviour | Permission checked |
|---|---|---|
api/masterdata/company | POST search: company_id, tax_number, name, email (format), limit (default 20, max 100); at least one filter; addresses and bank accounts per match | company/company::list |
company.list | GET paged list: page, limit 1–100, sort, order, tax_number (prefix), name, status | list |
company.get | one partner: basic data, taxpayer_status, addresses with KSH reference, bank accounts, users (always empty); out of scope or missing → 403 | list |
company.add | PUT or POST: company_name (required, max 255), short name, tax number, company group, status, optional bankaccount; duplicate on the first 8 tax digits → 422 with the existing ID; bank account via saveBankaccountForCompany(), failure only bankaccount_warning; the company group must be in scope (422) | company/company::edit |
company.delete | scope, then reference count; at 0 deleteApiCompany() with address and bank account links; physical deletion; referenced company → 422 with count | delete |
addressmaster.list / .get | search, status (active only by default), start, limit 1–200; missing → 404; no company scope (shared master) | masterdata/address::list |
addressmaster.add | postcode and city required; for an identical row the existing one with duplicate:true, otherwise addMaster() | edit |
addressmaster.delete | missing → 404; linked to companies → 409 CONFLICT; otherwise physical deletion | delete |
bankaccountmaster.list / .get | search, currency, status (default active), start, limit 1–200; missing → 404 | masterdata/bankaccount::list |
bankaccountmaster.add | bankaccount required, currency (default HUF), name, SWIFT, balance, status; normalised to the 24-digit account_id (invalid → 422); identical returns the existing one with duplicate:true | edit |
bankaccountmaster.delete | missing → 404; linked to companies → 422 (error_linked) | delete |
bankaccount.list / .get / .add / .delete | a partner's bank accounts by company_id or tax_number; add via saveBankaccountForCompany() (bankaccount_id, linked, normalized); delete removes only the link | API key and company scope only (isCompanyInApiScope), no function permission |
Data model
Table names carry the installation's own prefix in the database.
company, company_address, address, address_ksh, company_bankaccount, bankaccount, permission_scope.
Known limitations
- The checked keys (
company/company::listetc.) have no BASE, SUBSCRIPTION or SYSTEM classification;editanddeleteare not classified in the seeds. - Deleting a partner is physical, not a move to the bin.