154 operations, generated from Notificado's OpenAPI document. Each one has its own link, its parameters and examples ready to copy.
Authentication
The HTTP routes answer for a user's session: sign in with the example below and send the stored cookie on every call (-b cookies.txt).
Writes (POST) made outside a browser must state the origin with -H 'origin: https://www.notificado.co'; without it they are refused with X_CSRF_BLOCKED.
In the TypeScript examples, sessionCookie is the name=value pair of the cookie your sign-in answered.
Step 2 of 2 of an upload, after the PUT to requestUpload's url succeeded: pass the same key, kind, filename and contentType. The server reads back the STORED bytes, checks their real type (PDF, PNG or JPEG) and size, computes the SHA-256 and returns the document (id, sha256, bytes). Use the id with attachDocument. Refused when the PUT never landed or the bytes are not what was granted — re-run requestUpload rather than retrying.
Step 1 of 2 of an upload: get a signed, single-use PUT grant for ONE file. Pass kind (use "otro" for a notification attachment; certificado_vigencia | cedula | tarjeta_profesional are KYC files; provenance_proof proves where a recipient address came from), filename, contentType (application/pdf | image/png | image/jpeg) and size in bytes (at most 20 MB). Then HTTP PUT the raw bytes to `url` (prefix a path with the server origin) with header Content-Type exactly `contentType`, before `expiresAt` (epoch ms), and call confirmUpload with the returned `key`. Never send file bytes through this tool.
One case of the caller's firm by caseId (from caseList): 23-digit radicado, juzgado and its email, ciudad, especialidad, clase de proceso, cliente, its parties (role demandante | demandado | apoderado | otro, name, idNumber) and `locked` — true once a notification of it left draft, after which the case can no longer be edited. Returns no row for an id this firm does not have. Read-only.
Parameters of caseDetail
Name
In
Type
Required
caseId
Query
string (uuid)
Yes
orgId
Query
string (uuid)
Yes
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
The caller's firm's cases (procesos), newest first: id, 23-digit radicado, juzgado, ciudad, especialidad, clase de proceso and cliente. Use the id with caseDetail, or to start a notification on that case.
Parameters of caseList
Name
In
Type
Required
limit
Query
integer 1–200
No
orgId
Query
string (uuid)
Yes
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Check an email address BEFORE adding it as a recipient: syntax, disposable (throwaway) domain, role account (info@, notificaciones@), a likely typo of a common provider (gmial.com → gmail.com, returned as `suggestion`), and whether the domain has a mail server (MX lookup, 3 s). Returns verdict ok | warn | block with `reasons`. A `block` address cannot be added or sent to; on `warn`, show the reasons to the lawyer. Each call is recorded as diligence evidence. Read-only for the address itself — it sends nothing.
Create a case (proceso) in the caller's firm. `radicado` is the 23-digit Código Único de Radicación exactly as printed on the auto (dashes/spaces allowed) and is validated for structure; `juzgado` and `juzgadoEmail` are the court's name and buzón as listed in the CSJ directory; `cliente` is the firm's client. Refuses X_CASE_RADICADO_TAKEN when the firm already has that radicado — use the returned case id instead.
Correct a case of the caller's firm: pass caseId and only the fields to change (radicado — 23 digits, dashes/spaces allowed —, juzgado, juzgadoEmail, ciudad, especialidad, claseProceso, cliente). Refused X_CASE_LOCKED once a notification of the case left draft: what was sent is evidence. Do not use it to register a different proceso — use createCase.
Attach an already-uploaded document (documentId) to a DRAFT notification, as kind auto_admisorio | demanda | anexo | subsanacion | providencia | otro. The file is copied to immutable evidence storage and its SHA-256 recorded; total attachments must stay under 20 MB. Nothing is sent.
Rewrite a DRAFT art. 8 (Ley 2213) notification: pass orgId, notificationId, template "art8-personal", the providencia name and its date (YYYY-MM-DD), and optionally terminoDias and mensaje — omitting them removes them. The subject and body are recomposed from the template; the deemed-done and term-start sentences always stay. Refused once the notification was sent.
Create a DRAFT art. 8 (Ley 2213) personal notification on a case: pass orgId, caseId, template "art8-personal", the providencia name and its date (YYYY-MM-DD). The body already states when the notification is deemed done and when terms start. Nothing is sent and no credit is used; add recipients (a lawyer swears each address in the panel) and attach documents next.
Add a party to a case of the caller's firm: caseId, role demandante | demandado | apoderado | otro, the name as written in the demanda, and idNumber (cédula or NIT with its check digit) when known. A party is NOT a recipient: who gets notified, at which address, is sworn by the lawyer in the panel. Refused X_CASE_LOCKED once a notification of the case left draft.
Recipients whose notification could NOT be delivered (status bounced: the mail server refused it for good) or who marked it as unwanted (complained), newest first, with the case radicado. Without notificationId: only those not yet re-issued to another address. With notificationId: that notification's failed recipients, `switched: true` when already re-issued. Next steps for a bounce: verify the address, re-issue to another sworn address in the panel (switchChannel), or notify by physical means. Read-only.
Parameters of bounceAlerts
Name
In
Type
Required
notificationId
Query
string (uuid)
No
orgId
Query
string (uuid)
Yes
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Whether a memorial can be generated now for one notification in your organization. One row: ready, and when not ready the reason — "bounce" (a recipient bounced: NOT notified; re-issue to another address first), "not-delivered" (a recipient server has not accepted the message yet), "constancia-pending" or "term-pending" (still being produced, retry in a minute) — with the X_ code createMemorial would refuse with. Read-only.
Parameters of memorialReadiness
Name
In
Type
Required
notificationId
Query
string (uuid)
Yes
orgId
Query
string (uuid)
Yes
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
One notification by id: status, recipients with delivery status and how each address was obtained, attachments with SHA-256, and the evidence timeline (message.frozen, transport.sent, mail.delivery, bounces, downloads, acknowledgements) in chain order with UTC times. Opens are marked indicio (never proof of reading). Read-only.
Parameters of notificationDetail
Name
In
Type
Required
id
Query
string (uuid)
Yes
orgId
Query
string (uuid)
Yes
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
List the org’s notifications, newest first: id, case, status (draft | freezing | frozen | sending | sent | failed), subject, the frozen .eml SHA-256 and UTC timestamps. Read-only.
Parameters of notificationList
Name
In
Type
Required
limit
Query
integer 1–200
No
orgId
Query
string (uuid)
Yes
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
The memorials generated for one notification in your organization, newest first: id, createdAt, and the SHA-256 and size of the DOCX and the PDF, plus factsSha256 (the hash of the facts the memorial cites). Poll it after createMemorial until the new memorialId appears (seconds), then fetch the files with downloadMemorial. Read-only.
Parameters of notificationMemorials
Name
In
Type
Required
limit
Query
integer 1–200
No
notificationId
Query
string (uuid)
Yes
orgId
Query
string (uuid)
Yes
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Generates the memorial (DOCX + PDF draft, in Spanish) that informs the juzgado that personal notification under art. 8 Ley 2213 de 2022 was practised for one notification in your organization: radicado, juzgado, parties, each recipient with sent/delivered/acknowledged times in America/Bogota, the sworn forma de obtención, the constancia verify code and URL, the computed term dates with their disclaimer and inputsSha256, and the annexes with SHA-256. Returns the memorialId and the render job handle; download the files with downloadMemorial once notificationMemorials lists it (seconds). It is a DRAFT marked [LAWYER REVIEW]: a lawyer must review, sign and file it — nothing is sent to the court. Refused with X_MEMORIAL_BLOCKED_BOUNCE while any recipient bounced, X_MEMORIAL_NOT_DELIVERED before delivery, X_MEMORIAL_CONSTANCIA_PENDING / X_MEMORIAL_TERM_PENDING while those are still being produced.
Returns the bytes (base64, with filename, content type and SHA-256) of one generated memorial in your organization, as "docx" (editable, for the lawyer to review and sign) or "pdf" (with the constancia verification QR). The SHA-256 is re-checked against the memorial record before the bytes are served, and every download is recorded in the audit log. Fails X_MEMORIAL_NOT_FOUND for an unknown id or one whose render job has not finished.
REQUEST the send of a draft notification — REQUIRES HUMAN CONFIRMATION. Over MCP this never sends: it checks the draft is ready (recipients sworn by the lawyer in the panel, at least one attachment, under 20 MB) and returns { status: "awaiting_confirmation", confirmUrl, expiresAt }; hand confirmUrl to the lawyer, who confirms in the panel within 24 hours — only then is one credit per recipient consumed and the exact message frozen, timestamped and emailed. Call it once, with confirm: true, only after showing the lawyer the recipients and attachments. Do NOT call it to test, and do not retry after awaiting_confirmation. Requires an approved lawyer KYC (X_KYC_REQUIRED otherwise).
Staff only. Verify the hash-chained evidence log between two sequence numbers. Up to 50000 events are verified in the call and answer { ok, checked, firstBroken? }; a longer range (up to 10000000) is queued and answers { enqueued: true, jobId }. deep also re-hashes the raw provider objects. Read-only; every call is audited.
Returns the bytes (base64, with filename, content type and SHA-256) of the signed constancia PDF (kind "constancia") or the offline-verifiable evidence zip (kind "zip") of one notification in your organization; newest version unless "version" is given. Every call is recorded in the audit log and as an evidence.viewed event. Fails X_CONSTANCIA_NOT_FOUND before the first constancia is issued and X_EVIDENCE_ZIP_NOT_READY while the zip is still being built.
The caller's firm's deadlines (términos) under Ley 2213 art. 8, one row per notification × recipient: surtidaOn (envío + 2 días hábiles), termStartsOn (next día hábil) and termEndsOn (vencimiento, after termDays días hábiles), all YYYY-MM-DD in America/Bogota, skipping weekends, festivos, vacancia judicial and court closures. status 'blocked_bounce' means the recipient bounced: NOT notified, no dates. Filter by caseId, and by vencimiento day with from/to (YYYY-MM-DD, inclusive). Soonest vencimiento first. The dates are an ESTIMATE — always tell the user the judge decides (disclaimerKey), and cite calendarVersion + inputsSha256 when quoting one. Read-only.
Parameters of listDeadlines
Name
In
Type
Required
caseId
Query
string (uuid)
No
from
Query
string
No
limit
Query
integer 1–500
No
orgId
Query
string (uuid)
Yes
to
Query
string
No
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Credits balance of the caller's org: `balance` is how many recipients can still be notified (one credit per recipient, consumed on send), and `nextExpiryAt`/`nextExpiryCredits` say when the soonest batch of credits expires (UTC). Read before sending to more recipients than the balance covers.
Parameters of creditsBalance
Name
In
Type
Required
orgId
Query
string (uuid)
Yes
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Lists your organization's DIAN electronic invoices, newest first: status (queued, issued, rejected), DIAN number, CUFE, net, discount, IVA and gross amounts in COP minor units (centavos), due date for credit invoices, and whether the PDF / XML is ready for downloadInvoice.
Parameters of listMyInvoices
Name
In
Type
Required
limit
Query
integer 1–200
No
orgId
Query
string (uuid)
Yes
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Staff only (billing:grant). Files a four-eyes request to grant (credits.grant, needs invoiceRef) or adjust (credits.adjust) more than 100 credits for a customer org. A different staff member must approve it in the console; it then executes by itself. Returns the request.
Returns the bytes (base64, with filename, content type and SHA-256) of the PDF or XML of one DIAN electronic invoice of your organization (format "pdf" or "xml"), or of one of its credit notes when creditNoteId is given. Every call is recorded in the audit log. Fails X_INVOICE_FILE_NOT_READY while the document is not issued yet (listMyInvoices shows its status).
Returns the caller's firm's customer-referral link (https://www.notificado.co/registro?ref=O-XXXXXXXX) and its code, creating the code on first call. A firm that signs up through the link and makes its first payment earns the caller's firm one free month (a free subscription cycle, or 40 credits without a subscription) after a 30-day hold without refund. Needs billing:read in the given orgId.
No sessionPermission: publicMCP tool: verifyConstancia
Public check of a Notificado constancia: pass the verification code printed under its QR ("code") or the SHA-256 of the PDF file ("pdfSha256"). Returns one row: authentic, issuedAt (UTC and Bogotá), delivery status, the signed PDF's SHA-256, version, latestVersion and superseded. Never returns message content or recipient data; an unknown code or hash returns authentic=false with every other field null.
Parameters of verifyConstancia
Name
In
Type
Required
code
Query
string 1–32
No
pdfSha256
Query
string
No
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Staff only. Sending-abuse controls: every org's suspensions (active first; automatic = paused by complaint-watch pending review), org-specific sender limits (recipients per rolling hour/day), the per-plan defaults, and — with orgId — that org's active suspension, history, effective limit and usage in the last hour and 24 h. Org names and counts only.
Parameters of abuseOverview
Name
In
Type
Required
orgId
Query
string (uuid)
No
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Staff only. Billing figures, no personal data, for payments created in [from, to): per payment method and status the count and the gross, net (after discount), discount and IVA sums in COP minor units (centavos); totals of payments ever approved; refunds recorded in the window; and the DIAN invoices and credit notes queued (pending manual issue) or rejected right now.
Parameters of billingKpis
Name
In
Type
Required
from
Query
string (date-time)
Yes
to
Query
string (date-time)
Yes
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Staff only. The sales catalog and provider configuration, read-only, no personal data: active credit packs (sends, price in COP minor units, validity days), plans with the prices in force per interval, coupons that still validate (with redeemed and reserved counts), and env flags — name, set, the non-secret value of each provider selector and what the app built from it (effective, or the X_* error code refusing it). Secrets are never listed; ADMIN_ALLOWED_IPS only says whether it is set.
Parameters of catalogSnapshot
Name
In
Type
Required
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Staff only. Email deliverability for events recorded in [from, to), no personal data: per America/Bogota day and per recipient domain (domains with fewer than 3 distinct addresses are grouped as "(other)") the sends, deliveries, hard and soft bounces, complaints and deferrals with rates in percent; the customer orgs with the most bounces (org id, name and counts only); and the SES account standing (production access, sending enabled, 24 h quota and usage). Window at most 92 days.
Parameters of deliverability
Name
In
Type
Required
from
Query
string (date-time)
Yes
to
Query
string (date-time)
Yes
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Staff only. Evidence system health, no personal data: the last 14 daily anchors (Bogotá days; missing days listed; which timestamp authorities stamped each Merkle root), per-authority stamped/missed anchors plus tokens issued and stamp failures over the window, the last nightly evidence-chain verification verdict (ok, events checked, first broken seq), the latest NTP clock sample per host against the 100 ms threshold, and the mail transport account status (productionAccess false = SES sandbox: only verified recipients receive mail; 24 h quota and sent; errorCode when the provider could not be asked).
Parameters of evidenceHealth
Name
In
Type
Required
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Staff only. The background job queues, no personal data: per queue ready, delayed, running, suspended and dead counts plus oldestReadyMs; the last 50 dead letters (jobId, name, attempts, errorCode — never the input); every scheduled task with cron, time zone and nextRunAt (UTC); missing lists what this process cannot report (no driver, no introspection). Requeue a dead letter with requeueJob({ jobId }).
Parameters of jobQueues
Name
In
Type
Required
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Staff only. The conditions operations must act on, most severe first: tsa_failures (timestamp authority failures in 24 h), anchor_missed (no daily Merkle anchor for the last due Bogotá day), clock_offset (NTP offset past 100 ms), chain_verify_failed and staff_audit_chain_broken (a nightly hash-chain verification failed), ses_sending_paused, ses_sandbox, ses_quota_high, bounce_rate_high (> 5 %) and complaint_rate_high (> 0.1 %) over 24 h. Each row: code, severity (info | warn | critical), since (UTC), href (console page), value (the figure). No personal data.
Parameters of opsAlerts
Name
In
Type
Required
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Staff only. Operations counts, no personal data: lawyers pending KYC, four-eyes approvals pending, notifications and recipients created in the last 24 h by outcome (sent, failed, delivered, bounced, complained), and the job backlog.
Parameters of opsOverview
Name
In
Type
Required
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Staff only. Liveness of every configured provider, no personal data: each timestamp authority, the PDF signer, the mail transport, the evidence and uploads storage disks, the payment gateway, the e-invoice provider and captcha — each { kind, id, ok, latencyMs, checkedAt, detail } where detail.code names why a provider is down. Probes are read-only (nothing is stamped, signed, sent or charged) and the answer is cached for 60 s.
Parameters of providerHealth
Name
In
Type
Required
_first
Query
integer 1–10000page size; present, the response is the page envelope rather than the bare rows (1 to 10000)
No
_after
Query
stringthe endCursor a previous page answered; needs _first
Staff only. Four-eyes approval requests (credit grants/adjustments above 100 credits). Default: pending, oldest first; pass status for history (newest first). Every call is audited. A second staff member decides each with decideApproval in the console.
Staff only (admin:coupons:write). Archives a coupon by id (from adminListCoupons): new previews and checkouts refuse it; redemptions already made keep it. Idempotent. Recorded in the audit trail.
Staff only. A read-only snapshot of what one customer org's panel shows: the org, spendable credit balance and next expiry, KYC banner state, the 5 most recent notifications and cases. Read as a viewer of that org (no session, no writes possible). Needs a purpose (5+ characters). Every call is audited.
Staff only (superadmin, compliance). The staff-access audit trail for Bogotá days from..to (YYYY-MM-DD, both inclusive) as a CSV file: base64 bytes, filename and SHA-256. Oldest first; columns seq, at_utc, at_bogota, actor, action, outcome, subject, purpose, diff, prev_hash, hash. Optional filters actorId, subjectOrgId, subjectType/subjectId, outcome. At most 10000 rows — past that X_ADMIN_AUDIT_EXPORT_TOO_LARGE: split the range. This export is itself audited.
Staff only (superadmin, compliance). The staff-access audit trail: every staff read of customer data and every refusal on a staff surface, newest first. Filter by actorId, subjectOrgId, subjectType/subjectId, outcome (allowed|denied|failed), from/to (UTC). Page with cursor. This read is itself audited.
Staff only (admin:coupons:write). Creates a coupon: code (3–40 of A-Z 0-9 _ -, stored upper-case, never reused — X_PROMO_COUPON_CODE_TAKEN otherwise), kind percent (percentBps 1..10000) or fixed (amountOff in COP minor units, whole pesos), appliesTo pack | subscription | any, duration once | cycles (with cycles) | forever, optional firstPurchaseOnly, maxRedemptions across orgs, UTC validFrom/validTo and a campaign tag. The discount comes off the net before IVA. Recorded in the audit trail.
Parameters of adminCreateCoupon
Name
In
Type
Required
Idempotency-Key
Query
string ≤ 255Replays the first response for a repeated key.
No
amountOff
Body
objectinteger minor units plus an ISO 4217 currency code
Staff only. The customer 360 of one org: members (email, role, second factor), lawyer KYC (cédula masked), credit balance and the last 20 ledger rows, notifications by status, subscription and plan, payments and DIAN invoices in summary, recipients sent in the last 30 days with bounce and complaint rates, active suspension and sender limit with usage, deadline (term) counts, affiliate attribution, and the newest staff support notes. Needs a purpose (5+ characters). Every call is audited.
Staff only (admin:payments:read). Returns the stored body of one payment gateway delivery (eventId from adminPaymentDetail) as base64 bytes with its SHA-256, size, verified flag and received-at. Read-only. Every call is recorded in the staff audit trail.
Staff only. The offline-verifiable evidence zip of any org's notification, as base64 bytes with filename and SHA-256 (verified against the stored digest in this call); newest version unless version is given. Needs a purpose (5+ characters). Recorded on the staff trail, in the firm's audit log and as an evidence.viewed event. X_EVIDENCE_ZIP_NOT_READY while the zip is being built (it is queued) — ask again shortly.
Staff only (ops, superadmin). Requeue one finished job — dead, cancelled or done — by jobId (from jobQueues), optionally fromStep. A running or waiting job is refused. Through MCP the call waits for your human to confirm it in /admin/mcp. Audited.
Staff only. The lawyers waiting for KYC review across every firm, oldest first: name, cédula, tarjeta profesional, SIRNA email, the firm name, and the uploaded certificado de vigencia (id, SHA-256, type). Every call is audited. Decide each with approveKyc or rejectKyc.
Staff only. Approve a pending lawyer KYC after checking the certificado de vigencia against the CSJ: records the decision with its reason, grants the firm its one-time trial credits and mails the lawyer. Pass orgId and profileId exactly as listKycQueue returned them.
Staff only. Reject a pending lawyer KYC (for example an expired or unreadable certificado de vigencia). The reason is mailed to the lawyer verbatim, so write it for them. Pass orgId and profileId exactly as listKycQueue returned them.
Staff only (admin:coupons:read). Lists coupons newest first: code, percent (basis points) or fixed amount (COP minor units), what it applies to (pack | subscription | any), duration (once | cycles | forever), first-purchase-only, max redemptions, UTC validity window, campaign tag, archived instant, and live redemption counts (reserved by open checkouts, committed by approved payments). Archived coupons only with includeArchived: true; filter by campaign.
Staff only (admin:payments:read). Lists payments across every customer org, newest first: org, gateway reference, status, method, gross in COP minor units (centavos), created/approved instants and the DIAN invoice status. Filter by status, orgId, a createdAt window (from inclusive, to exclusive) and q (reference prefix, Wompi transaction id, payment id prefix or part of the org name); page with cursor. Every call is recorded in the staff audit trail.
Staff only (admin:invoicing:issue). Step 1 of recording an invoice issued by hand in DIAN software: returns a signed PUT url for its PDF (application/pdf, at most 5 MB). PUT the bytes there, then call recordManualInvoice with the returned key as pdfKey.
Staff only (admin:invoicing:issue). The queued DIAN invoices and credit notes (document: invoice | credit_note; a credit note names the invoice it corrects) waiting to be issued by hand (EINVOICE_PROVIDER=manual), oldest first, each with buyer, lines, amounts in COP minor units (centavos), form of payment and our reference. Issue each in the DIAN software, then record it with recordManualInvoice. Every call is recorded in the staff audit trail.
Staff only (admin:invoicing:issue). Records a DIAN invoice or credit note issued by hand in external DIAN software for a queued document (see pendingManualInvoices): its DIAN number, CUFE/CUDE (96 hex chars), issue time, and the PDF uploaded via requestManualInvoiceUpload (pdfKey). Marks it issued exactly once; the customer can then download it.
Staff only. Finds notifications of any customer org by 23-digit radicado, recipient email (or part of it), SES MessageId, notification or recipient id, or constancia verify code; newest first, with org, case radicado, status, sentAt, recipient count and each live recipient (recipientId, email, status; the matched one first). At least 3 characters. Every call is audited with its term.
Staff only. Finds customer orgs by part of the name, a member email, an org id prefix (4+ hex chars) or a 23-digit radicado; newest first, with member count, KYC state and credit balance. At least 3 characters. Every call is audited with its term.
Staff only. One customer org: members (email, role, MFA), lawyer KYC status (cédula masked), credit balance with the last 20 ledger rows, notification counts by status, pending approvals. Every call is audited.
Staff only (admin:payments:read). One payment by paymentId, in any org: amounts (COP minor units), status history markers, the gateway events about it (verified or not, applied or with the apply error, SHA-256 and size of the stored raw body), the credit ledger rows it produced, its DIAN invoice and credit notes, refunds and refund approval requests, and the amount still refundable. Every call is recorded in the staff audit trail.
Staff only. The raw provider payload behind one evidence event (SES/SNS JSON, inbound reply notification, transport receipt), base64, exactly as stored, with its SHA-256 recomputed now and compared with the digest the hash-chained event committed to (match). Needs a purpose (5+ characters). Read-only; every call is audited.
Staff only. One recipient of a notification as the evidence shows it: recipient and notification (org, case radicado, frozen .eml SHA-256), address provenance and sworn statement, attachment SHA-256s, every evidence event in chain order (UTC and Bogotá time, seq, hash, prevHash, indicio flag for opens, hasRaw) and the constancia versions. Read-only. Every call is audited.
Staff only (admin:payments:read). Enqueues a reconciliation of one payment now: the server asks the payment gateway for its transaction and applies the answer (idempotent — an approved payment stays approved; missing credits or invoice are repaired). Returns the status before it runs; read adminPaymentDetail again after a few seconds. Recorded in the staff audit trail.
Staff only. Queue the next version of a notification's constancia (signed PDF built from every evidence event so far); earlier versions are never overwritten and keep verifying as superseded. Needs a reason (5+ characters). Fails X_CONSTANCIA_NOT_FOUND before the first constancia exists. Audited, and recorded in the firm's own audit log.
Staff only (admin:payments:refund). Files a four-eyes refund request for one approved payment: gross in COP minor units (at most the refundable amount adminPaymentDetail reports), a reason, and refundReason customer|chargeback|error. A DIFFERENT staff member must approve it (decideApproval); approval then records the refund, takes back unused credits and queues the DIAN credit note. It does NOT move money: staff return it in the Wompi dashboard. Returns the approval request.
Staff only. Reads the S3 Object Lock actually applied to one evidence object (one HEAD, never the content): mode COMPLIANCE | GOVERNANCE | NONE (or n/a on a local dev disk), retainUntil (UTC), legalHold. Omit key to check the newest stored timestamp token. In production alert is true, with alertReason, when the object is deletable. Audited.
Staff only (superadmin, ops, support, compliance). Append a support note to one customer org: what happened and what was agreed (up to 4000 characters). Notes are staff-only, insert-only (never edited or deleted — write a new note to correct one) and shown on the org 360. Through MCP the call waits for your human to confirm it in /admin/mcp. Audited.