---
title: Compliance
description: Pull the prescription and classified-drugs books, preview the fiscal payload, and list registered devices.
---

You serve inspectors from `apps/server/src/features/compliance/route.ts`. All four endpoints need authentication and return paginated JSON you can print or export. Keep your licence numbers current in `/operations/printing-and-settings` so every book ties back to a registered premise.

### Present the prescription book

Call `GET /compliance/prescription-book` with optional `from_date` and `to_date` filters. Each row shows `rx_number`, patient name and ID, prescriber name and licence, `status`, `created_at`, the staff member in `created_by_name`, and a `line_count` of items on that prescription. The response includes the retention note to keep records for 2 years for NDA inspection.

```bash
curl -H "Authorization: Bearer $TOKEN" \
  "http://localhost:8000/api/v1/compliance/prescription-book?from_date=2026-01-01&to_date=2026-09-27"
```

Page size defaults to 50. When an inspector asks for a period, pass the exact window rather than filtering client side. Deleted prescriptions never appear because the query filters `p.is_deleted = 0`.

### Present the classified-drugs book

Call `GET /compliance/classified-drugs-book` with the same optional date filters. It joins `controlled_dispense_log` to `medicines` where `is_controlled = 1`, so only controlled products appear. Each row shows when it was dispensed, the medicine name, quantity, patient national ID, doctor licence, who dispensed it, and the `sale_id` linking back to the transaction. The retention note marks it as the Class A/B/C Group II statutory record.

```bash
curl -H "Authorization: Bearer $TOKEN" \
  "http://localhost:8000/api/v1/compliance/classified-drugs-book?from_date=2026-01-01&to_date=2026-09-27"
```

Page size defaults to 50 here as well. If an inspector queries a single dispense, follow the row `sale_id` back to the sale and its prescription.

### Preview the fiscal payload

Call `GET /compliance/efris-preview/:saleId` before submitting a sale to URA EFRIS. You get the seller block (branch TIN, branch id, invoice number, ICV), the buyer block (TIN and name from the sale), totals with the stored `vat_breakdown`, and the full item lines. The `fiscalization` block reminds you to submit this payload to receive the FDN, verification code, and QR code.

```bash
curl -H "Authorization: Bearer $TOKEN" \
  http://localhost:8000/api/v1/compliance/efris-preview/SALE_ID
```

A missing sale returns a 404 with `Sale not found`. Treat the preview as read only and never edit its totals by hand.

### List registered devices

Call `GET /compliance/devices` for the paginated device register, each row joined with its `branch_name` and ordered newest first. Page size defaults to 50. Use it to prove which terminals belong to which branch during an audit, and reconcile any unassigned device before the inspector asks about it. The list covers every registered device, so an empty result means nothing is registered yet.
Cross-check the count against the physical terminals in each branch.

```bash
curl -H "Authorization: Bearer $TOKEN" \
  http://localhost:8000/api/v1/compliance/devices
```

### Next steps

**[Reports and dashboard](/operations/reports-and-dashboard)**

Reconcile the VAT report with the fiscal preview before filing.

**[Printing and settings](/operations/printing-and-settings)**

Confirm TIN, VAT, and licence numbers printed on receipts.