Compliance

Pull the prescription and classified-drugs books, preview the fiscal payload, and list registered devices.

You serve inspectors from apps/server/src/features/compliance/route.ts. All four endpoints need authentication and return paginated JSON you can print or export. Keep your licence numbers current in /operations/printing-and-settings so every book ties back to a registered premise.

Present the prescription book

Call GET /compliance/prescription-book with optional from_date and to_date filters. Each row shows rx_number, patient name and ID, prescriber name and licence, status, created_at, the staff member in created_by_name, and a line_count of items on that prescription. The response includes the retention note to keep records for 2 years for NDA inspection.

curl -H "Authorization: Bearer $TOKEN" \
  "http://localhost:8000/api/v1/compliance/prescription-book?from_date=2026-01-01&to_date=2026-09-27"

Page size defaults to 50. When an inspector asks for a period, pass the exact window rather than filtering client side. Deleted prescriptions never appear because the query filters p.is_deleted = 0.

Present the classified-drugs book

Call GET /compliance/classified-drugs-book with the same optional date filters. It joins controlled_dispense_log to medicines where is_controlled = 1, so only controlled products appear. Each row shows when it was dispensed, the medicine name, quantity, patient national ID, doctor licence, who dispensed it, and the sale_id linking back to the transaction. The retention note marks it as the Class A/B/C Group II statutory record.

curl -H "Authorization: Bearer $TOKEN" \
  "http://localhost:8000/api/v1/compliance/classified-drugs-book?from_date=2026-01-01&to_date=2026-09-27"

Page size defaults to 50 here as well. If an inspector queries a single dispense, follow the row sale_id back to the sale and its prescription.

Preview the fiscal payload

Call GET /compliance/efris-preview/:saleId before submitting a sale to URA EFRIS. You get the seller block (branch TIN, branch id, invoice number, ICV), the buyer block (TIN and name from the sale), totals with the stored vat_breakdown, and the full item lines. The fiscalization block reminds you to submit this payload to receive the FDN, verification code, and QR code.

curl -H "Authorization: Bearer $TOKEN" \
  http://localhost:8000/api/v1/compliance/efris-preview/SALE_ID

A missing sale returns a 404 with Sale not found. Treat the preview as read only and never edit its totals by hand.

List registered devices

Call GET /compliance/devices for the paginated device register, each row joined with its branch_name and ordered newest first. Page size defaults to 50. Use it to prove which terminals belong to which branch during an audit, and reconcile any unassigned device before the inspector asks about it. The list covers every registered device, so an empty result means nothing is registered yet. Cross-check the count against the physical terminals in each branch.

curl -H "Authorization: Bearer $TOKEN" \
  http://localhost:8000/api/v1/compliance/devices

Next steps