@greensecurity/javascript-sdk 0.45.0-beta.22 → 0.45.0-beta.24

package/src/sdk/medicalproducts.ts

@@ -56,6 +56,8 @@ export class MedicalProducts extends ClientSDK {
    * Sortable by id, product_name, brand_name, primary_di, status, created_at and updated_at.
    *
    * Requires the `medical_products` / `view` permission.
+   *
+   * **Permissions.** Requires the `medical_products.view` permission.
    */
   async listAllMedicalProducts(
     request: operations.ListAllMedicalProductsRequest,
@@ -77,6 +79,8 @@ export class MedicalProducts extends ClientSDK {
    * Adds a medical product to the medical product catalog.
    *
    * Requires the `medical_products` / `add` permission.
+   *
+   * **Permissions.** Requires the `medical_products.add` permission.
    */
   async createMedicalProduct(
     request: components.MedicalProductCreate,
@@ -96,6 +100,8 @@ export class MedicalProducts extends ClientSDK {
    * Returns a single medical product. Retired records are not returned.
    *
    * Requires the `medical_products` / `view` permission.
+   *
+   * **Permissions.** Requires the `medical_products.view` permission.
    */
   async getMedicalProduct(
     request: operations.GetMedicalProductRequest,
@@ -115,6 +121,8 @@ export class MedicalProducts extends ClientSDK {
    * Updates a medical product. Keys the request omits are left as they are.
    *
    * Requires the `medical_products` / `edit` permission.
+   *
+   * **Permissions.** Requires the `medical_products.edit` permission.
    */
   async updateMedicalProduct(
     request: operations.UpdateMedicalProductRequest,
@@ -134,6 +142,8 @@ export class MedicalProducts extends ClientSDK {
    * Identical to `PUT`: both leave omitted keys as they are.
    *
    * Requires the `medical_products` / `edit` permission.
+   *
+   * **Permissions.** Requires the `medical_products.edit` permission.
    */
   async patchMedicalProduct(
     request: operations.PatchMedicalProductRequest,
@@ -155,6 +165,8 @@ export class MedicalProducts extends ClientSDK {
    * referencing it. Retiring also frees the record's natural key for a replacement.
    *
    * Requires the `medical_products` / `delete` permission.
+   *
+   * **Permissions.** Requires the `medical_products.delete` permission.
    */
   async deleteMedicalProduct(
     request: operations.DeleteMedicalProductRequest,
@@ -183,6 +195,8 @@ export class MedicalProducts extends ClientSDK {
    * Sortable by id, name, brand_name, status, created_at and updated_at.
    *
    * Requires the `medical_products` / `view` permission.
+   *
+   * **Permissions.** Requires the `medical_products.view` permission.
    */
   async listAllMedicalProductFamilies(
     request: operations.ListAllMedicalProductFamiliesRequest,
@@ -207,6 +221,8 @@ export class MedicalProducts extends ClientSDK {
    * Adds a product family to the medical product catalog.
    *
    * Requires the `medical_products` / `add` permission.
+   *
+   * **Permissions.** Requires the `medical_products.add` permission.
    */
   async createMedicalProductFamily(
     request: components.MedicalProductFamilyCreate,
@@ -226,6 +242,8 @@ export class MedicalProducts extends ClientSDK {
    * Returns a single product family. Retired records are not returned.
    *
    * Requires the `medical_products` / `view` permission.
+   *
+   * **Permissions.** Requires the `medical_products.view` permission.
    */
   async getMedicalProductFamily(
     request: operations.GetMedicalProductFamilyRequest,
@@ -245,6 +263,8 @@ export class MedicalProducts extends ClientSDK {
    * Updates a product family. Keys the request omits are left as they are.
    *
    * Requires the `medical_products` / `edit` permission.
+   *
+   * **Permissions.** Requires the `medical_products.edit` permission.
    */
   async updateMedicalProductFamily(
     request: operations.UpdateMedicalProductFamilyRequest,
@@ -264,6 +284,8 @@ export class MedicalProducts extends ClientSDK {
    * Identical to `PUT`: both leave omitted keys as they are.
    *
    * Requires the `medical_products` / `edit` permission.
+   *
+   * **Permissions.** Requires the `medical_products.edit` permission.
    */
   async patchMedicalProductFamily(
     request: operations.PatchMedicalProductFamilyRequest,
@@ -285,6 +307,8 @@ export class MedicalProducts extends ClientSDK {
    * referencing it. Retiring also frees the record's natural key for a replacement.
    *
    * Requires the `medical_products` / `delete` permission.
+   *
+   * **Permissions.** Requires the `medical_products.delete` permission.
    */
   async deleteMedicalProductFamily(
     request: operations.DeleteMedicalProductFamilyRequest,
@@ -310,6 +334,8 @@ export class MedicalProducts extends ClientSDK {
    * Sortable by id, name, sort_order, created_at and updated_at.
    *
    * Requires the `medical_product_categories` / `view` permission.
+   *
+   * **Permissions.** Requires the `medical_product_categories.view` permission.
    */
   async listAllMedicalProductCategories(
     request: operations.ListAllMedicalProductCategoriesRequest,
@@ -334,6 +360,8 @@ export class MedicalProducts extends ClientSDK {
    * Adds a product category to the medical product catalog.
    *
    * Requires the `medical_product_categories` / `add` permission.
+   *
+   * **Permissions.** Requires the `medical_product_categories.add` permission.
    */
   async createMedicalProductCategory(
     request: components.MedicalProductCategoryCreate,
@@ -353,6 +381,8 @@ export class MedicalProducts extends ClientSDK {
    * Returns a single product category. Retired records are not returned.
    *
    * Requires the `medical_product_categories` / `view` permission.
+   *
+   * **Permissions.** Requires the `medical_product_categories.view` permission.
    */
   async getMedicalProductCategory(
     request: operations.GetMedicalProductCategoryRequest,
@@ -372,6 +402,8 @@ export class MedicalProducts extends ClientSDK {
    * Updates a product category. Keys the request omits are left as they are.
    *
    * Requires the `medical_product_categories` / `edit` permission.
+   *
+   * **Permissions.** Requires the `medical_product_categories.edit` permission.
    */
   async updateMedicalProductCategory(
     request: operations.UpdateMedicalProductCategoryRequest,
@@ -391,6 +423,8 @@ export class MedicalProducts extends ClientSDK {
    * Identical to `PUT`: both leave omitted keys as they are.
    *
    * Requires the `medical_product_categories` / `edit` permission.
+   *
+   * **Permissions.** Requires the `medical_product_categories.edit` permission.
    */
   async patchMedicalProductCategory(
     request: operations.PatchMedicalProductCategoryRequest,
@@ -412,6 +446,8 @@ export class MedicalProducts extends ClientSDK {
    * referencing it. Retiring also frees the record's natural key for a replacement.
    *
    * Requires the `medical_product_categories` / `delete` permission.
+   *
+   * **Permissions.** Requires the `medical_product_categories.delete` permission.
    */
   async deleteMedicalProductCategory(
     request: operations.DeleteMedicalProductCategoryRequest,
@@ -437,6 +473,8 @@ export class MedicalProducts extends ClientSDK {
    * Sortable by id, name, country, status, created_at and updated_at.
    *
    * Requires the `manufacturers` / `view` permission.
+   *
+   * **Permissions.** Requires the `manufacturers.view` permission.
    */
   async listAllManufacturers(
     request: operations.ListAllManufacturersRequest,
@@ -458,6 +496,8 @@ export class MedicalProducts extends ClientSDK {
    * Adds a manufacturer to the medical product catalog.
    *
    * Requires the `manufacturers` / `add` permission.
+   *
+   * **Permissions.** Requires the `manufacturers.add` permission.
    */
   async createManufacturer(
     request: components.ManufacturerCreate,
@@ -477,6 +517,8 @@ export class MedicalProducts extends ClientSDK {
    * Returns a single manufacturer. Retired records are not returned.
    *
    * Requires the `manufacturers` / `view` permission.
+   *
+   * **Permissions.** Requires the `manufacturers.view` permission.
    */
   async getManufacturer(
     request: operations.GetManufacturerRequest,
@@ -496,6 +538,8 @@ export class MedicalProducts extends ClientSDK {
    * Updates a manufacturer. Keys the request omits are left as they are.
    *
    * Requires the `manufacturers` / `edit` permission.
+   *
+   * **Permissions.** Requires the `manufacturers.edit` permission.
    */
   async updateManufacturer(
     request: operations.UpdateManufacturerRequest,
@@ -515,6 +559,8 @@ export class MedicalProducts extends ClientSDK {
    * Identical to `PUT`: both leave omitted keys as they are.
    *
    * Requires the `manufacturers` / `edit` permission.
+   *
+   * **Permissions.** Requires the `manufacturers.edit` permission.
    */
   async patchManufacturer(
     request: operations.PatchManufacturerRequest,
@@ -536,6 +582,8 @@ export class MedicalProducts extends ClientSDK {
    * referencing it. Retiring also frees the record's natural key for a replacement.
    *
    * Requires the `manufacturers` / `delete` permission.
+   *
+   * **Permissions.** Requires the `manufacturers.delete` permission.
    */
   async deleteManufacturer(
     request: operations.DeleteManufacturerRequest,
@@ -561,6 +609,8 @@ export class MedicalProducts extends ClientSDK {
    * Sortable by id, name, country, status, created_at and updated_at.
    *
    * Requires the `distributors` / `view` permission.
+   *
+   * **Permissions.** Requires the `distributors.view` permission.
    */
   async listAllDistributors(
     request: operations.ListAllDistributorsRequest,
@@ -582,6 +632,8 @@ export class MedicalProducts extends ClientSDK {
    * Adds a distributor to the medical product catalog.
    *
    * Requires the `distributors` / `add` permission.
+   *
+   * **Permissions.** Requires the `distributors.add` permission.
    */
   async createDistributor(
     request: components.DistributorCreate,
@@ -601,6 +653,8 @@ export class MedicalProducts extends ClientSDK {
    * Returns a single distributor. Retired records are not returned.
    *
    * Requires the `distributors` / `view` permission.
+   *
+   * **Permissions.** Requires the `distributors.view` permission.
    */
   async getDistributor(
     request: operations.GetDistributorRequest,
@@ -620,6 +674,8 @@ export class MedicalProducts extends ClientSDK {
    * Updates a distributor. Keys the request omits are left as they are.
    *
    * Requires the `distributors` / `edit` permission.
+   *
+   * **Permissions.** Requires the `distributors.edit` permission.
    */
   async updateDistributor(
     request: operations.UpdateDistributorRequest,
@@ -639,6 +695,8 @@ export class MedicalProducts extends ClientSDK {
    * Identical to `PUT`: both leave omitted keys as they are.
    *
    * Requires the `distributors` / `edit` permission.
+   *
+   * **Permissions.** Requires the `distributors.edit` permission.
    */
   async patchDistributor(
     request: operations.PatchDistributorRequest,
@@ -660,6 +718,8 @@ export class MedicalProducts extends ClientSDK {
    * referencing it. Retiring also frees the record's natural key for a replacement.
    *
    * Requires the `distributors` / `delete` permission.
+   *
+   * **Permissions.** Requires the `distributors.delete` permission.
    */
   async deleteDistributor(
     request: operations.DeleteDistributorRequest,

package/src/sdk/mobiledevices.ts

@@ -13,6 +13,8 @@ export class MobileDevices extends ClientSDK {
    *
    * @remarks
    * Add mobile device
+   *
+   * **Permissions.** Requires the `mobile_devices.add` permission.
    */
   async addMobileDevice(
     request: operations.AddMobileDeviceRequestBody,

package/src/sdk/organizations.ts

@@ -29,18 +29,22 @@ export class Organizations extends ClientSDK {
    * @remarks
    * List or search facilities.
    *
+   * **Permissions.** Requires any of `facilities.view`, `facility.search` or `targeted_facilities.view`. Callers holding only `targeted_facilities.view` or `facility.search` see a reduced record, and expansion scopes are applied only to facilities within their read scope.
+   *
    * Available `expand` scopes are:
    *
-   * - facility.appointment_policy
-   * - facility.contacts
-   * - facility.vendor_counts
-   * - facility.flu_credential
-   * - facility.scrubs_policy
-   * - facility.system
-   * - facility.vendor_guest_policy
-   * - facility.vendor_policy
-   * - facility.visitor_policy
-   * - facility.workflow
+   * - `facility.system`
+   * - `facility.contacts`
+   * - `facility.vendor_counts`
+   * - `facility.appointment_policy`
+   * - `facility.vendor_policy`
+   * - `facility.vendor_guest_policy`
+   * - `facility.visitor_policy`
+   * - `facility.workflow_policy`
+   * - `facility.scrubs_policy`
+   * - `facility.flu_credential`
+   *
+   * Unrecognised values are ignored. Expansion is applied only to facilities the caller can read; rows outside that scope are returned unexpanded.
    */
   async listOrSearchFacilities(
     request: operations.ListOrSearchFacilitiesRequest,
@@ -60,6 +64,26 @@ export class Organizations extends ClientSDK {
    *
    * @remarks
    * Retrieve an individual facility.
+   *
+   * **Permissions.** Requires `facilities.view`, `facility_profile.view`, or `targeted_facilities.view`. `facility.search` does not grant access on its own — it only extends the reach of a `targeted_facilities.view` caller to a facility they are not targeted at, returning the public summary for it instead of a 403.
+   *
+   * - Callers with `facilities.view` or `facility_profile.view` can look up any facility, but only receive full expansion for their own facility; for any other facility, expansion is dropped and only the public summary is returned.
+   * - Callers with `targeted_facilities.view` receive the full record and full expansion for a facility they are targeted at (a vendor's target facilities, or a facility/system user's own facility). For a facility they are not targeted at, they receive the public summary (no expansion) if they also hold `facility.search`, or a 401 otherwise.
+   *
+   * Available `expand` scopes are:
+   *
+   * - `facility.system`
+   * - `facility.contacts`
+   * - `facility.vendor_counts`
+   * - `facility.appointment_policy`
+   * - `facility.vendor_policy`
+   * - `facility.vendor_guest_policy`
+   * - `facility.visitor_policy`
+   * - `facility.workflow_policy`
+   * - `facility.scrubs_policy`
+   * - `facility.flu_credential`
+   *
+   * Unrecognised values are ignored. Expansion is dropped entirely for callers who can only see the facility's public summary.
    */
   async getFacility(
     request: operations.GetFacilityRequest,
@@ -77,6 +101,8 @@ export class Organizations extends ClientSDK {
    *
    * @remarks
    * List or search departments.
+   *
+   * **Permissions.** Requires the `departments.view` permission.
    */
   async listOrSearchDepartments(
     request: operations.ListOrSearchDepartmentsRequest,
@@ -100,9 +126,15 @@ export class Organizations extends ClientSDK {
    * and parent system), the link status, and per-facility counts of the
    * company's individuals targeting it.
    *
-   * When `include_potential_targets=true`, returns ALL non-deleted facilities
-   * via a LEFT JOIN. Targeted rows carry their CTF `id` and `status`; non-targeted
-   * rows have `id: null` and `status: "Not Targeted"`.
+   * When `include_potential_targets=true`, returns every non-deleted facility
+   * reachable via a LEFT JOIN against the caller's *potential-target* scope:
+   * for a facility/system/vendor/company-manager caller, that's the public,
+   * non-deleted, listed facility directory plus the caller's own read scope
+   * for Facility — not the read scope alone, so the roster includes
+   * facilities the caller has no existing relationship with. An API-user
+   * caller is the exception: it sees only its own read scope, with no
+   * directory added. Targeted rows carry their CTF `id` and `status`;
+   * non-targeted rows have `id: null` and `status: "Not Targeted"`.
    *
    * Access control: the URL's `company_id` must be in the caller's read scope
    * for Company (a company manager's or vendor's own company, or a company
@@ -112,9 +144,13 @@ export class Organizations extends ClientSDK {
    * Filter with `has_individual` / `has_active_individual` to drive the
    * facility roster views.
    *
+   * **Permissions.** Requires the `target_facilities.view` permission.
+   *
    * Available `expand` scopes are:
    *
-   * - company_target_facility.facility
+   * - `company_target_facility.facility`
+   *
+   * Any other value is rejected with `422 Unprocessable Entity`.
    */
   async listCompanyTargetFacilities(
     request: operations.ListCompanyTargetFacilitiesRequest,
@@ -142,15 +178,25 @@ export class Organizations extends ClientSDK {
    *
    * Access control: the URL's `company_id` must be in the caller's update
    * scope for Company, AND the `facility_id` must be in the caller's create
-   * scope for Facility (a facility on the company's site, or a facility
-   * reachable via the API user's site/system/facility-scoped activation).
-   * Either being out of scope returns `404 Company not found` /
-   * `404 Facility not found` respectively. Deleted facilities also return
-   * `404 Facility not found`.
+   * scope for Facility. For a facility/system/vendor/company-manager caller,
+   * that create scope is widened the same way listing's potential-target
+   * scope is: it includes the public, non-deleted, listed facility directory
+   * in addition to the caller's own create scope, so a non-deleted publicly
+   * listed facility can be targeted even when it isn't otherwise in the
+   * caller's Facility relation. An API-user caller is the exception —
+   * restricted to its own create scope (a facility on the company's site, or
+   * a facility reachable via the API user's site/system/facility-scoped
+   * activation), with no directory added. Either being out of scope returns
+   * `404 Company not found` / `404 Facility not found` respectively. Deleted
+   * facilities also return `404 Facility not found`.
+   *
+   * **Permissions.** Requires the `target_facilities.add` permission.
    *
    * Available `expand` scopes are:
    *
-   * - company_target_facility.facility
+   * - `company_target_facility.facility`
+   *
+   * Any other value is rejected with `422 Unprocessable Entity`.
    */
   async createCompanyTargetFacility(
     request: operations.CreateCompanyTargetFacilityRequest,
@@ -178,6 +224,8 @@ export class Organizations extends ClientSDK {
    * scope for Company (a company manager's or vendor's own company, or a
    * company whose app is activated for the API user). Callers outside that
    * scope receive `404 Company not found`.
+   *
+   * **Permissions.** Requires the `target_facilities.delete` permission.
    */
   async deleteCompanyTargetFacility(
     request: operations.DeleteCompanyTargetFacilityRequest,
@@ -202,6 +250,8 @@ export class Organizations extends ClientSDK {
    *
    * Access control: the URL's `company_id` must be in the caller's read scope for Company. Callers
    * outside that scope receive `404 Company not found`.
+   *
+   * **Permissions.** Requires the `target_facilities.view` permission.
    */
   async exportCompanyTargetFacilities(
     request: operations.ExportCompanyTargetFacilitiesRequest,
@@ -220,6 +270,8 @@ export class Organizations extends ClientSDK {
    * @remarks
    * Poll the state of an asynchronous company target facilities export job. When `ready` is true,
    * the export is complete and can be downloaded via the download endpoint.
+   *
+   * **Permissions.** Requires the `target_facilities.view` permission.
    */
   async getCompanyTargetFacilitiesExportStatus(
     request: operations.GetCompanyTargetFacilitiesExportStatusRequest,
@@ -238,6 +290,8 @@ export class Organizations extends ClientSDK {
    * @remarks
    * Returns the exported company target facilities CSV via a 302 redirect to a short-lived presigned S3 URL.
    * If the export is still being generated, returns 202 with a JSON `{ ready: false }` payload.
+   *
+   * **Permissions.** Requires the `target_facilities.view` permission.
    */
   async downloadCompanyTargetFacilitiesExport(
     request: operations.DownloadCompanyTargetFacilitiesExportRequest,
@@ -276,6 +330,8 @@ export class Organizations extends ClientSDK {
    *   * API users: must pass `company_id`. Both the company and the facility
    *     must be activated for the caller's marketplace app
    *     (`MarketplaceAppActivation`).
+   *
+   * **Permissions.** Requires the `vendors.view` permission.
    */
   async listFacilityVendors(
     request: operations.ListFacilityVendorsRequest,
@@ -309,6 +365,8 @@ export class Organizations extends ClientSDK {
    *   * API users — `company_id` required; both the company AND the facility must be
    *     activated for the caller's marketplace app via the join-scoped
    *     `MarketplaceAppActivation` check.
+   *
+   * **Permissions.** Requires the `vendors.view` permission.
    */
   async exportFacilityVendors(
     request: operations.ExportFacilityVendorsRequest,
@@ -327,6 +385,8 @@ export class Organizations extends ClientSDK {
    * @remarks
    * Poll the state of an asynchronous facility vendors export job. When `ready` is true,
    * the export is complete and can be downloaded via the download endpoint.
+   *
+   * **Permissions.** Requires the `vendors.view` permission.
    */
   async getFacilityVendorsExportStatus(
     request: operations.GetFacilityVendorsExportStatusRequest,
@@ -346,6 +406,8 @@ export class Organizations extends ClientSDK {
    * Returns the exported facility vendors CSV via a 302 redirect to a short-lived
    * presigned S3 URL. If the export is still being generated, returns 202 with a JSON
    * `{ ready: false }` payload.
+   *
+   * **Permissions.** Requires the `vendors.view` permission.
    */
   async downloadFacilityVendorsExport(
     request: operations.DownloadFacilityVendorsExportRequest,
@@ -364,10 +426,14 @@ export class Organizations extends ClientSDK {
    * @remarks
    * List or search department contacts.
    *
+   * **Permissions.** Requires the `departments.view` permission.
+   *
    * Available `expand` scopes are:
    *
-   * - department_membership.contact
-   * - department_membership.department
+   * - `department_membership.contact`
+   * - `department_membership.department`
+   *
+   * Unrecognised values are ignored.
    */
   async listOrSearchDepartmentContacts(
     request: operations.ListOrSearchDepartmentContactsRequest,

package/src/sdk/paymentprofile.ts

@@ -18,6 +18,8 @@ export class PaymentProfile extends ClientSDK {
    * This includes credit_balance and payment_profile which are account-level data, not invoice-specific.
    *
    * Only vendors and company managers can access this endpoint.
+   *
+   * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
    */
   async getPaymentProfile(
     options?: RequestOptions,
@@ -35,6 +37,8 @@ export class PaymentProfile extends ClientSDK {
    * Deletes the payment profile for the logged-in user (vendor or company manager).
    *
    * Only vendors and company managers can access this endpoint.
+   *
+   * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
    */
   async deletePaymentProfile(
     options?: RequestOptions,

package/src/sdk/reports.ts

@@ -31,6 +31,8 @@ export class Reports extends ClientSDK {
    * for `ScheduledReport` — the facility or system it belongs to, a scheduled report the
    * caller is an explicit recipient of, or a scheduled report whose app is activated for
    * the API user. Callers outside that scope receive `404 Scheduled report not found`.
+   *
+   * **Permissions.** Requires the `scheduled_reports.view` permission.
    */
   async initiateScheduledReport(
     request: operations.InitiateScheduledReportRequest,
@@ -71,6 +73,8 @@ export class Reports extends ClientSDK {
    * `FullReport` — the facility or system it was run for, a recipient of the schedule that
    * produced it, or a report whose app is activated for the API user. Callers outside that
    * scope receive `404 Full report not found`.
+   *
+   * **Permissions.** Requires the `scheduled_reports.view` permission.
    */
   async getFullReport(
     request: operations.GetFullReportRequest,

package/src/sdk/supportarticles.ts

@@ -16,6 +16,8 @@ export class SupportArticles extends ClientSDK {
    *
    * @remarks
    * List or search support articles for FAQ.
+   *
+   * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
    */
   async listOrSearchSupportArticles(
     request: operations.ListOrSearchSupportArticlesRequest,
@@ -39,12 +41,16 @@ export class SupportArticles extends ClientSDK {
    * @remarks
    * Retrieve an individual support article.
    *
+   * **Permissions.** Requires a valid token. This endpoint is not gated on a named permission - the caller's role and their relationship to the record decide what is returned.
+   *
    * Available `expand` scopes are:
    *
-   * - support_article.description
-   * - support_article.published
-   * - support_article.notes
-   * - support_article.support_category
+   * - `support_article.description`
+   * - `support_article.notes`
+   * - `support_article.published`
+   * - `support_article.support_category`
+   *
+   * Unrecognised values are ignored.
    */
   async getSupportArticle(
     request: operations.GetSupportArticleRequest,

package/src/sdk/systems.ts

@@ -14,9 +14,24 @@ export class Systems extends ClientSDK {
    * @remarks
    * List or search systems.
    *
+   * **Permissions.** Requires the `systems.view` permission. `facilities.view` is additionally needed for the `system.facilities` expansion scope to be applied.
+   *
    * Available `expand` scopes are:
    *
-   * - system.facilities
+   * - `system.facilities`
+   * - `system.location`
+   * - `system.green_contacts`
+   * - `system.vendor_counts`
+   * - `system.calendar_policy`
+   * - `system.sales_info`
+   * - `system.auto_approve_policy`
+   * - `system.vendor_guest_policy`
+   * - `system.gpo`
+   * - `system.aggregate`
+   * - `system.pricing_model`
+   * - `system.initiate_visit_request_requirements`
+   *
+   * Unrecognised values are ignored. Each scope is also accepted without the `system.` prefix (`location`, `gpo`, and so on) for backwards compatibility. Expansion is dropped for callers without facilities-view permission.
    */
   async listSystems(
     request: operations.ListSystemsRequest,