@greensecurity/javascript-sdk 0.45.0-beta.22 → 0.45.0-beta.24

package/src/react-query/organizationsListCompanyTargetFacilities.ts

@@ -80,9 +80,15 @@ export type OrganizationsListCompanyTargetFacilitiesQueryError =
  * and parent system), the link status, and per-facility counts of the
  * company's individuals targeting it.
  *
- * When `include_potential_targets=true`, returns ALL non-deleted facilities
- * via a LEFT JOIN. Targeted rows carry their CTF `id` and `status`; non-targeted
- * rows have `id: null` and `status: "Not Targeted"`.
+ * When `include_potential_targets=true`, returns every non-deleted facility
+ * reachable via a LEFT JOIN against the caller's *potential-target* scope:
+ * for a facility/system/vendor/company-manager caller, that's the public,
+ * non-deleted, listed facility directory plus the caller's own read scope
+ * for Facility — not the read scope alone, so the roster includes
+ * facilities the caller has no existing relationship with. An API-user
+ * caller is the exception: it sees only its own read scope, with no
+ * directory added. Targeted rows carry their CTF `id` and `status`;
+ * non-targeted rows have `id: null` and `status: "Not Targeted"`.
  *
  * Access control: the URL's `company_id` must be in the caller's read scope
  * for Company (a company manager's or vendor's own company, or a company
@@ -92,9 +98,13 @@ export type OrganizationsListCompanyTargetFacilitiesQueryError =
  * Filter with `has_individual` / `has_active_individual` to drive the
  * facility roster views.
  *
+ * **Permissions.** Requires the `target_facilities.view` permission.
+ *
  * Available `expand` scopes are:
  *
- * - company_target_facility.facility
+ * - `company_target_facility.facility`
+ *
+ * Any other value is rejected with `422 Unprocessable Entity`.
  */
 export function useOrganizationsListCompanyTargetFacilities(
   request: operations.ListCompanyTargetFacilitiesRequest,
@@ -126,9 +136,15 @@ export function useOrganizationsListCompanyTargetFacilities(
  * and parent system), the link status, and per-facility counts of the
  * company's individuals targeting it.
  *
- * When `include_potential_targets=true`, returns ALL non-deleted facilities
- * via a LEFT JOIN. Targeted rows carry their CTF `id` and `status`; non-targeted
- * rows have `id: null` and `status: "Not Targeted"`.
+ * When `include_potential_targets=true`, returns every non-deleted facility
+ * reachable via a LEFT JOIN against the caller's *potential-target* scope:
+ * for a facility/system/vendor/company-manager caller, that's the public,
+ * non-deleted, listed facility directory plus the caller's own read scope
+ * for Facility — not the read scope alone, so the roster includes
+ * facilities the caller has no existing relationship with. An API-user
+ * caller is the exception: it sees only its own read scope, with no
+ * directory added. Targeted rows carry their CTF `id` and `status`;
+ * non-targeted rows have `id: null` and `status: "Not Targeted"`.
  *
  * Access control: the URL's `company_id` must be in the caller's read scope
  * for Company (a company manager's or vendor's own company, or a company
@@ -138,9 +154,13 @@ export function useOrganizationsListCompanyTargetFacilities(
  * Filter with `has_individual` / `has_active_individual` to drive the
  * facility roster views.
  *
+ * **Permissions.** Requires the `target_facilities.view` permission.
+ *
  * Available `expand` scopes are:
  *
- * - company_target_facility.facility
+ * - `company_target_facility.facility`
+ *
+ * Any other value is rejected with `422 Unprocessable Entity`.
  */
 export function useOrganizationsListCompanyTargetFacilitiesSuspense(
   request: operations.ListCompanyTargetFacilitiesRequest,
@@ -172,9 +192,15 @@ export function useOrganizationsListCompanyTargetFacilitiesSuspense(
  * and parent system), the link status, and per-facility counts of the
  * company's individuals targeting it.
  *
- * When `include_potential_targets=true`, returns ALL non-deleted facilities
- * via a LEFT JOIN. Targeted rows carry their CTF `id` and `status`; non-targeted
- * rows have `id: null` and `status: "Not Targeted"`.
+ * When `include_potential_targets=true`, returns every non-deleted facility
+ * reachable via a LEFT JOIN against the caller's *potential-target* scope:
+ * for a facility/system/vendor/company-manager caller, that's the public,
+ * non-deleted, listed facility directory plus the caller's own read scope
+ * for Facility — not the read scope alone, so the roster includes
+ * facilities the caller has no existing relationship with. An API-user
+ * caller is the exception: it sees only its own read scope, with no
+ * directory added. Targeted rows carry their CTF `id` and `status`;
+ * non-targeted rows have `id: null` and `status: "Not Targeted"`.
  *
  * Access control: the URL's `company_id` must be in the caller's read scope
  * for Company (a company manager's or vendor's own company, or a company
@@ -184,9 +210,13 @@ export function useOrganizationsListCompanyTargetFacilitiesSuspense(
  * Filter with `has_individual` / `has_active_individual` to drive the
  * facility roster views.
  *
+ * **Permissions.** Requires the `target_facilities.view` permission.
+ *
  * Available `expand` scopes are:
  *
- * - company_target_facility.facility
+ * - `company_target_facility.facility`
+ *
+ * Any other value is rejected with `422 Unprocessable Entity`.
  */
 export function useOrganizationsListCompanyTargetFacilitiesInfinite(
   request: operations.ListCompanyTargetFacilitiesRequest,
@@ -232,9 +262,15 @@ export function useOrganizationsListCompanyTargetFacilitiesInfinite(
  * and parent system), the link status, and per-facility counts of the
  * company's individuals targeting it.
  *
- * When `include_potential_targets=true`, returns ALL non-deleted facilities
- * via a LEFT JOIN. Targeted rows carry their CTF `id` and `status`; non-targeted
- * rows have `id: null` and `status: "Not Targeted"`.
+ * When `include_potential_targets=true`, returns every non-deleted facility
+ * reachable via a LEFT JOIN against the caller's *potential-target* scope:
+ * for a facility/system/vendor/company-manager caller, that's the public,
+ * non-deleted, listed facility directory plus the caller's own read scope
+ * for Facility — not the read scope alone, so the roster includes
+ * facilities the caller has no existing relationship with. An API-user
+ * caller is the exception: it sees only its own read scope, with no
+ * directory added. Targeted rows carry their CTF `id` and `status`;
+ * non-targeted rows have `id: null` and `status: "Not Targeted"`.
  *
  * Access control: the URL's `company_id` must be in the caller's read scope
  * for Company (a company manager's or vendor's own company, or a company
@@ -244,9 +280,13 @@ export function useOrganizationsListCompanyTargetFacilitiesInfinite(
  * Filter with `has_individual` / `has_active_individual` to drive the
  * facility roster views.
  *
+ * **Permissions.** Requires the `target_facilities.view` permission.
+ *
  * Available `expand` scopes are:
  *
- * - company_target_facility.facility
+ * - `company_target_facility.facility`
+ *
+ * Any other value is rejected with `422 Unprocessable Entity`.
  */
 export function useOrganizationsListCompanyTargetFacilitiesInfiniteSuspense(
   request: operations.ListCompanyTargetFacilitiesRequest,

package/src/react-query/organizationsListFacilityVendors.ts

@@ -95,6 +95,8 @@ export type OrganizationsListFacilityVendorsQueryError =
  *   * API users: must pass `company_id`. Both the company and the facility
  *     must be activated for the caller's marketplace app
  *     (`MarketplaceAppActivation`).
+ *
+ * **Permissions.** Requires the `vendors.view` permission.
  */
 export function useOrganizationsListFacilityVendors(
   request: operations.ListFacilityVendorsRequest,
@@ -141,6 +143,8 @@ export function useOrganizationsListFacilityVendors(
  *   * API users: must pass `company_id`. Both the company and the facility
  *     must be activated for the caller's marketplace app
  *     (`MarketplaceAppActivation`).
+ *
+ * **Permissions.** Requires the `vendors.view` permission.
  */
 export function useOrganizationsListFacilityVendorsSuspense(
   request: operations.ListFacilityVendorsRequest,
@@ -187,6 +191,8 @@ export function useOrganizationsListFacilityVendorsSuspense(
  *   * API users: must pass `company_id`. Both the company and the facility
  *     must be activated for the caller's marketplace app
  *     (`MarketplaceAppActivation`).
+ *
+ * **Permissions.** Requires the `vendors.view` permission.
  */
 export function useOrganizationsListFacilityVendorsInfinite(
   request: operations.ListFacilityVendorsRequest,
@@ -247,6 +253,8 @@ export function useOrganizationsListFacilityVendorsInfinite(
  *   * API users: must pass `company_id`. Both the company and the facility
  *     must be activated for the caller's marketplace app
  *     (`MarketplaceAppActivation`).
+ *
+ * **Permissions.** Requires the `vendors.view` permission.
  */
 export function useOrganizationsListFacilityVendorsInfiniteSuspense(
   request: operations.ListFacilityVendorsRequest,

package/src/react-query/organizationsListOrSearchDepartmentContacts.ts

@@ -77,10 +77,14 @@ export type OrganizationsListOrSearchDepartmentContactsQueryError =
  * @remarks
  * List or search department contacts.
  *
+ * **Permissions.** Requires the `departments.view` permission.
+ *
  * Available `expand` scopes are:
  *
- * - department_membership.contact
- * - department_membership.department
+ * - `department_membership.contact`
+ * - `department_membership.department`
+ *
+ * Unrecognised values are ignored.
  */
 export function useOrganizationsListOrSearchDepartmentContacts(
   request: operations.ListOrSearchDepartmentContactsRequest,
@@ -109,10 +113,14 @@ export function useOrganizationsListOrSearchDepartmentContacts(
  * @remarks
  * List or search department contacts.
  *
+ * **Permissions.** Requires the `departments.view` permission.
+ *
  * Available `expand` scopes are:
  *
- * - department_membership.contact
- * - department_membership.department
+ * - `department_membership.contact`
+ * - `department_membership.department`
+ *
+ * Unrecognised values are ignored.
  */
 export function useOrganizationsListOrSearchDepartmentContactsSuspense(
   request: operations.ListOrSearchDepartmentContactsRequest,
@@ -141,10 +149,14 @@ export function useOrganizationsListOrSearchDepartmentContactsSuspense(
  * @remarks
  * List or search department contacts.
  *
+ * **Permissions.** Requires the `departments.view` permission.
+ *
  * Available `expand` scopes are:
  *
- * - department_membership.contact
- * - department_membership.department
+ * - `department_membership.contact`
+ * - `department_membership.department`
+ *
+ * Unrecognised values are ignored.
  */
 export function useOrganizationsListOrSearchDepartmentContactsInfinite(
   request: operations.ListOrSearchDepartmentContactsRequest,
@@ -187,10 +199,14 @@ export function useOrganizationsListOrSearchDepartmentContactsInfinite(
  * @remarks
  * List or search department contacts.
  *
+ * **Permissions.** Requires the `departments.view` permission.
+ *
  * Available `expand` scopes are:
  *
- * - department_membership.contact
- * - department_membership.department
+ * - `department_membership.contact`
+ * - `department_membership.department`
+ *
+ * Unrecognised values are ignored.
  */
 export function useOrganizationsListOrSearchDepartmentContactsInfiniteSuspense(
   request: operations.ListOrSearchDepartmentContactsRequest,

package/src/react-query/organizationsListOrSearchDepartments.ts

@@ -76,6 +76,8 @@ export type OrganizationsListOrSearchDepartmentsQueryError =
  *
  * @remarks
  * List or search departments.
+ *
+ * **Permissions.** Requires the `departments.view` permission.
  */
 export function useOrganizationsListOrSearchDepartments(
   request: operations.ListOrSearchDepartmentsRequest,
@@ -103,6 +105,8 @@ export function useOrganizationsListOrSearchDepartments(
  *
  * @remarks
  * List or search departments.
+ *
+ * **Permissions.** Requires the `departments.view` permission.
  */
 export function useOrganizationsListOrSearchDepartmentsSuspense(
   request: operations.ListOrSearchDepartmentsRequest,
@@ -130,6 +134,8 @@ export function useOrganizationsListOrSearchDepartmentsSuspense(
  *
  * @remarks
  * List or search departments.
+ *
+ * **Permissions.** Requires the `departments.view` permission.
  */
 export function useOrganizationsListOrSearchDepartmentsInfinite(
   request: operations.ListOrSearchDepartmentsRequest,
@@ -171,6 +177,8 @@ export function useOrganizationsListOrSearchDepartmentsInfinite(
  *
  * @remarks
  * List or search departments.
+ *
+ * **Permissions.** Requires the `departments.view` permission.
  */
 export function useOrganizationsListOrSearchDepartmentsInfiniteSuspense(
   request: operations.ListOrSearchDepartmentsRequest,

package/src/react-query/organizationsListOrSearchFacilities.ts

@@ -77,18 +77,22 @@ export type OrganizationsListOrSearchFacilitiesQueryError =
  * @remarks
  * List or search facilities.
  *
+ * **Permissions.** Requires any of `facilities.view`, `facility.search` or `targeted_facilities.view`. Callers holding only `targeted_facilities.view` or `facility.search` see a reduced record, and expansion scopes are applied only to facilities within their read scope.
+ *
  * Available `expand` scopes are:
  *
- * - facility.appointment_policy
- * - facility.contacts
- * - facility.vendor_counts
- * - facility.flu_credential
- * - facility.scrubs_policy
- * - facility.system
- * - facility.vendor_guest_policy
- * - facility.vendor_policy
- * - facility.visitor_policy
- * - facility.workflow
+ * - `facility.system`
+ * - `facility.contacts`
+ * - `facility.vendor_counts`
+ * - `facility.appointment_policy`
+ * - `facility.vendor_policy`
+ * - `facility.vendor_guest_policy`
+ * - `facility.visitor_policy`
+ * - `facility.workflow_policy`
+ * - `facility.scrubs_policy`
+ * - `facility.flu_credential`
+ *
+ * Unrecognised values are ignored. Expansion is applied only to facilities the caller can read; rows outside that scope are returned unexpanded.
  */
 export function useOrganizationsListOrSearchFacilities(
   request: operations.ListOrSearchFacilitiesRequest,
@@ -117,18 +121,22 @@ export function useOrganizationsListOrSearchFacilities(
  * @remarks
  * List or search facilities.
  *
+ * **Permissions.** Requires any of `facilities.view`, `facility.search` or `targeted_facilities.view`. Callers holding only `targeted_facilities.view` or `facility.search` see a reduced record, and expansion scopes are applied only to facilities within their read scope.
+ *
  * Available `expand` scopes are:
  *
- * - facility.appointment_policy
- * - facility.contacts
- * - facility.vendor_counts
- * - facility.flu_credential
- * - facility.scrubs_policy
- * - facility.system
- * - facility.vendor_guest_policy
- * - facility.vendor_policy
- * - facility.visitor_policy
- * - facility.workflow
+ * - `facility.system`
+ * - `facility.contacts`
+ * - `facility.vendor_counts`
+ * - `facility.appointment_policy`
+ * - `facility.vendor_policy`
+ * - `facility.vendor_guest_policy`
+ * - `facility.visitor_policy`
+ * - `facility.workflow_policy`
+ * - `facility.scrubs_policy`
+ * - `facility.flu_credential`
+ *
+ * Unrecognised values are ignored. Expansion is applied only to facilities the caller can read; rows outside that scope are returned unexpanded.
  */
 export function useOrganizationsListOrSearchFacilitiesSuspense(
   request: operations.ListOrSearchFacilitiesRequest,
@@ -157,18 +165,22 @@ export function useOrganizationsListOrSearchFacilitiesSuspense(
  * @remarks
  * List or search facilities.
  *
+ * **Permissions.** Requires any of `facilities.view`, `facility.search` or `targeted_facilities.view`. Callers holding only `targeted_facilities.view` or `facility.search` see a reduced record, and expansion scopes are applied only to facilities within their read scope.
+ *
  * Available `expand` scopes are:
  *
- * - facility.appointment_policy
- * - facility.contacts
- * - facility.vendor_counts
- * - facility.flu_credential
- * - facility.scrubs_policy
- * - facility.system
- * - facility.vendor_guest_policy
- * - facility.vendor_policy
- * - facility.visitor_policy
- * - facility.workflow
+ * - `facility.system`
+ * - `facility.contacts`
+ * - `facility.vendor_counts`
+ * - `facility.appointment_policy`
+ * - `facility.vendor_policy`
+ * - `facility.vendor_guest_policy`
+ * - `facility.visitor_policy`
+ * - `facility.workflow_policy`
+ * - `facility.scrubs_policy`
+ * - `facility.flu_credential`
+ *
+ * Unrecognised values are ignored. Expansion is applied only to facilities the caller can read; rows outside that scope are returned unexpanded.
  */
 export function useOrganizationsListOrSearchFacilitiesInfinite(
   request: operations.ListOrSearchFacilitiesRequest,
@@ -211,18 +223,22 @@ export function useOrganizationsListOrSearchFacilitiesInfinite(
  * @remarks
  * List or search facilities.
  *
+ * **Permissions.** Requires any of `facilities.view`, `facility.search` or `targeted_facilities.view`. Callers holding only `targeted_facilities.view` or `facility.search` see a reduced record, and expansion scopes are applied only to facilities within their read scope.
+ *
  * Available `expand` scopes are:
  *
- * - facility.appointment_policy
- * - facility.contacts
- * - facility.vendor_counts
- * - facility.flu_credential
- * - facility.scrubs_policy
- * - facility.system
- * - facility.vendor_guest_policy
- * - facility.vendor_policy
- * - facility.visitor_policy
- * - facility.workflow
+ * - `facility.system`
+ * - `facility.contacts`
+ * - `facility.vendor_counts`
+ * - `facility.appointment_policy`
+ * - `facility.vendor_policy`
+ * - `facility.vendor_guest_policy`
+ * - `facility.visitor_policy`
+ * - `facility.workflow_policy`
+ * - `facility.scrubs_policy`
+ * - `facility.flu_credential`
+ *
+ * Unrecognised values are ignored. Expansion is applied only to facilities the caller can read; rows outside that scope are returned unexpanded.
  */
 export function useOrganizationsListOrSearchFacilitiesInfiniteSuspense(
   request: operations.ListOrSearchFacilitiesRequest,

package/src/react-query/paymentProfileDeletePaymentProfile.ts

@@ -52,6 +52,8 @@ export type PaymentProfileDeletePaymentProfileMutationError =
  * Deletes the payment profile for the logged-in user (vendor or company manager).
  *
  * Only vendors and company managers can access this endpoint.
+ *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
  */
 export function usePaymentProfileDeletePaymentProfileMutation(
   options?: MutationHookOptions<

package/src/react-query/paymentProfileGetPaymentProfile.ts

@@ -55,6 +55,8 @@ export type PaymentProfileGetPaymentProfileQueryError =
  * This includes credit_balance and payment_profile which are account-level data, not invoice-specific.
  *
  * Only vendors and company managers can access this endpoint.
+ *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
  */
 export function usePaymentProfileGetPaymentProfile(
   options?: QueryHookOptions<
@@ -83,6 +85,8 @@ export function usePaymentProfileGetPaymentProfile(
  * This includes credit_balance and payment_profile which are account-level data, not invoice-specific.
  *
  * Only vendors and company managers can access this endpoint.
+ *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
  */
 export function usePaymentProfileGetPaymentProfileSuspense(
   options?: SuspenseQueryHookOptions<

package/src/react-query/reportsGetFullReport.ts

@@ -81,6 +81,8 @@ export type ReportsGetFullReportQueryError =
  * `FullReport` — the facility or system it was run for, a recipient of the schedule that
  * produced it, or a report whose app is activated for the API user. Callers outside that
  * scope receive `404 Full report not found`.
+ *
+ * **Permissions.** Requires the `scheduled_reports.view` permission.
  */
 export function useReportsGetFullReport(
   request: operations.GetFullReportRequest,
@@ -131,6 +133,8 @@ export function useReportsGetFullReport(
  * `FullReport` — the facility or system it was run for, a recipient of the schedule that
  * produced it, or a report whose app is activated for the API user. Callers outside that
  * scope receive `404 Full report not found`.
+ *
+ * **Permissions.** Requires the `scheduled_reports.view` permission.
  */
 export function useReportsGetFullReportSuspense(
   request: operations.GetFullReportRequest,

package/src/react-query/reportsInitiateScheduledReport.ts

@@ -69,6 +69,8 @@ export type ReportsInitiateScheduledReportMutationError =
  * for `ScheduledReport` — the facility or system it belongs to, a scheduled report the
  * caller is an explicit recipient of, or a scheduled report whose app is activated for
  * the API user. Callers outside that scope receive `404 Scheduled report not found`.
+ *
+ * **Permissions.** Requires the `scheduled_reports.view` permission.
  */
 export function useReportsInitiateScheduledReportMutation(
   options?: MutationHookOptions<

package/src/react-query/supportArticlesGetSupportArticle.ts

@@ -59,12 +59,16 @@ export type SupportArticlesGetSupportArticleQueryError =
  * @remarks
  * Retrieve an individual support article.
  *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
+ *
  * Available `expand` scopes are:
  *
- * - support_article.description
- * - support_article.published
- * - support_article.notes
- * - support_article.support_category
+ * - `support_article.description`
+ * - `support_article.notes`
+ * - `support_article.published`
+ * - `support_article.support_category`
+ *
+ * Unrecognised values are ignored.
  */
 export function useSupportArticlesGetSupportArticle(
   request: operations.GetSupportArticleRequest,
@@ -93,12 +97,16 @@ export function useSupportArticlesGetSupportArticle(
  * @remarks
  * Retrieve an individual support article.
  *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
+ *
  * Available `expand` scopes are:
  *
- * - support_article.description
- * - support_article.published
- * - support_article.notes
- * - support_article.support_category
+ * - `support_article.description`
+ * - `support_article.notes`
+ * - `support_article.published`
+ * - `support_article.support_category`
+ *
+ * Unrecognised values are ignored.
  */
 export function useSupportArticlesGetSupportArticleSuspense(
   request: operations.GetSupportArticleRequest,

package/src/react-query/supportArticlesListOrSearchSupportArticles.ts

@@ -76,6 +76,8 @@ export type SupportArticlesListOrSearchSupportArticlesQueryError =
  *
  * @remarks
  * List or search support articles for FAQ.
+ *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
  */
 export function useSupportArticlesListOrSearchSupportArticles(
   request: operations.ListOrSearchSupportArticlesRequest,
@@ -103,6 +105,8 @@ export function useSupportArticlesListOrSearchSupportArticles(
  *
  * @remarks
  * List or search support articles for FAQ.
+ *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
  */
 export function useSupportArticlesListOrSearchSupportArticlesSuspense(
   request: operations.ListOrSearchSupportArticlesRequest,
@@ -130,6 +134,8 @@ export function useSupportArticlesListOrSearchSupportArticlesSuspense(
  *
  * @remarks
  * List or search support articles for FAQ.
+ *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
  */
 export function useSupportArticlesListOrSearchSupportArticlesInfinite(
   request: operations.ListOrSearchSupportArticlesRequest,
@@ -171,6 +177,8 @@ export function useSupportArticlesListOrSearchSupportArticlesInfinite(
  *
  * @remarks
  * List or search support articles for FAQ.
+ *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
  */
 export function useSupportArticlesListOrSearchSupportArticlesInfiniteSuspense(
   request: operations.ListOrSearchSupportArticlesRequest,

package/src/react-query/systemsListSystems.ts

@@ -77,9 +77,24 @@ export type SystemsListSystemsQueryError =
  * @remarks
  * List or search systems.
  *
+ * **Permissions.** Requires the `systems.view` permission. `facilities.view` is additionally needed for the `system.facilities` expansion scope to be applied.
+ *
  * Available `expand` scopes are:
  *
- * - system.facilities
+ * - `system.facilities`
+ * - `system.location`
+ * - `system.green_contacts`
+ * - `system.vendor_counts`
+ * - `system.calendar_policy`
+ * - `system.sales_info`
+ * - `system.auto_approve_policy`
+ * - `system.vendor_guest_policy`
+ * - `system.gpo`
+ * - `system.aggregate`
+ * - `system.pricing_model`
+ * - `system.initiate_visit_request_requirements`
+ *
+ * Unrecognised values are ignored. Each scope is also accepted without the `system.` prefix (`location`, `gpo`, and so on) for backwards compatibility. Expansion is dropped for callers without facilities-view permission.
  */
 export function useSystemsListSystems(
   request: operations.ListSystemsRequest,
@@ -105,9 +120,24 @@ export function useSystemsListSystems(
  * @remarks
  * List or search systems.
  *
+ * **Permissions.** Requires the `systems.view` permission. `facilities.view` is additionally needed for the `system.facilities` expansion scope to be applied.
+ *
  * Available `expand` scopes are:
  *
- * - system.facilities
+ * - `system.facilities`
+ * - `system.location`
+ * - `system.green_contacts`
+ * - `system.vendor_counts`
+ * - `system.calendar_policy`
+ * - `system.sales_info`
+ * - `system.auto_approve_policy`
+ * - `system.vendor_guest_policy`
+ * - `system.gpo`
+ * - `system.aggregate`
+ * - `system.pricing_model`
+ * - `system.initiate_visit_request_requirements`
+ *
+ * Unrecognised values are ignored. Each scope is also accepted without the `system.` prefix (`location`, `gpo`, and so on) for backwards compatibility. Expansion is dropped for callers without facilities-view permission.
  */
 export function useSystemsListSystemsSuspense(
   request: operations.ListSystemsRequest,
@@ -136,9 +166,24 @@ export function useSystemsListSystemsSuspense(
  * @remarks
  * List or search systems.
  *
+ * **Permissions.** Requires the `systems.view` permission. `facilities.view` is additionally needed for the `system.facilities` expansion scope to be applied.
+ *
  * Available `expand` scopes are:
  *
- * - system.facilities
+ * - `system.facilities`
+ * - `system.location`
+ * - `system.green_contacts`
+ * - `system.vendor_counts`
+ * - `system.calendar_policy`
+ * - `system.sales_info`
+ * - `system.auto_approve_policy`
+ * - `system.vendor_guest_policy`
+ * - `system.gpo`
+ * - `system.aggregate`
+ * - `system.pricing_model`
+ * - `system.initiate_visit_request_requirements`
+ *
+ * Unrecognised values are ignored. Each scope is also accepted without the `system.` prefix (`location`, `gpo`, and so on) for backwards compatibility. Expansion is dropped for callers without facilities-view permission.
  */
 export function useSystemsListSystemsInfinite(
   request: operations.ListSystemsRequest,
@@ -181,9 +226,24 @@ export function useSystemsListSystemsInfinite(
  * @remarks
  * List or search systems.
  *
+ * **Permissions.** Requires the `systems.view` permission. `facilities.view` is additionally needed for the `system.facilities` expansion scope to be applied.
+ *
  * Available `expand` scopes are:
  *
- * - system.facilities
+ * - `system.facilities`
+ * - `system.location`
+ * - `system.green_contacts`
+ * - `system.vendor_counts`
+ * - `system.calendar_policy`
+ * - `system.sales_info`
+ * - `system.auto_approve_policy`
+ * - `system.vendor_guest_policy`
+ * - `system.gpo`
+ * - `system.aggregate`
+ * - `system.pricing_model`
+ * - `system.initiate_visit_request_requirements`
+ *
+ * Unrecognised values are ignored. Each scope is also accepted without the `system.` prefix (`location`, `gpo`, and so on) for backwards compatibility. Expansion is dropped for callers without facilities-view permission.
  */
 export function useSystemsListSystemsInfiniteSuspense(
   request: operations.ListSystemsRequest,

package/src/react-query/usersChangePassword.ts

@@ -51,6 +51,8 @@ export type UsersChangePasswordMutationError =
  *
  * @remarks
  * Change the user's password to the new passed as parameter
+ *
+ * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
  */
 export function useUsersChangePasswordMutation(
   options?: MutationHookOptions<