24 Reports
3 operations.
24.0.1 listReports
GET /api/reports
Lists the caller’s PDF reports (newest first), optionally filtered to one campaign by dataset_slug or one asset by asset_tag.
Why it exists. ‡ List the inspection reports available to the caller, optionally scoped to one campaign or one asset, so a completed campaign’s write-ups — or everything written about a given asset, across campaigns — can be found without knowing their filenames.
Lists the caller’s PDF reports (pdf_reports), newest first, scoped by the pdf_reports_select RLS policy (owner or same organization). Pass dataset_slug to narrow results to one campaign; pass asset_tag to narrow to reports citing a given asset; omit both to list every report the caller may read. Each row carries its own dataset_slug, lifted from the facility column, and its own asset_tags, lifted from metadata.asset_tags.
Authentication: SupabaseAuth, CookieAuth
Returns — reports · count · truncated · limit
Field names as the handler returns them; the source states no types for them.
Effect — reads pdf_reports
Parameters
| Name | In | Required | Type | Notes |
|---|---|---|---|---|
limit |
query | no | integer | |
dataset_slug |
query | no | string | |
asset_tag |
query | no | string |
Responses
| Status | Meaning | Body |
|---|---|---|
200 |
A list of the caller’s reports. | |
401 |
Not authenticated. | Error |
500 |
Server error. | Error |
24.0.2 createReport
POST /api/reports
Generate a report from a set of findings and notes an engineer has selected, so the write-up cites its evidence instead of restating it from memory.
Why it exists. † Generate a report from a set of findings and notes an engineer has selected, so the write-up cites exactly the evidence behind it rather than restating it from memory, and stays private to its author until sharing is built.
Called by — components/workspaces/worklist-client.tsx
Reached from — /w/integrity/worklist
Renders a PDF citing the given findings and notes and stores it privately to the caller; at least one of finding_ids/note_ids is required. Requested ids outside the caller’s organisation, retired, or unresolved are dropped and returned as omitted rather than failing the request outright, unless none could be resolved (404 instead). Sharing is not built yet, so any visibility other than private is rejected (400).
Authentication: SupabaseAuth, CookieAuth
Returns — report · omitted
Field names as the handler returns them; the source states no types for them.
Effect — reads equipment_damage_mechanisms · location_notes
Request body
| Field | Type | Required |
|---|---|---|
title |
string | yes |
organization_id |
string | yes |
finding_ids |
array of string | no |
note_ids |
array of string | no |
narrative |
string | no |
dataset_slug |
string | no |
Responses
| Status | Meaning | Body |
|---|---|---|
201 |
The filed report’s storage location, plus any requested finding_ids/note_ids that could not be resolved. | |
400 |
Missing title/organization_id, neither finding_ids nor note_ids given, or a visibility other than private was requested. | Error |
401 |
Not signed in, or no access token available to authorise the report. | Error |
404 |
None of the requested findings or notes could be found. | Error |
500 |
The database refused a read for a reason the route could not classify. | Error |
502 |
The report-generation gateway rejected or failed the render/upload. | Error |
503 |
The report-generation gateway is unreachable. | Error |
24.0.3 createReportDownloadUrl
GET /api/reports/{id}/download
Issues a short-lived secure link to download a report’s PDF. Only the report’s owner sees it, unless they have shared it with their organization.
Why it exists. ‡ Hand back one report as a file, through a link that expires, so a report leaves the platform as a record without exposing where it is stored.
Called by — components/chat/ai-chat-interface.tsx · components/workspaces/storage-client.tsx · components/workspaces/worklist-client.tsx
Reached from — /w/data-explorer/storage · /w/integrity/storage · /w/integrity/worklist
Returns a short-lived signed URL for a report’s stored PDF. Authorisation is left entirely to row-level security: the lookup runs on the caller’s own client, so the owner sees their report and other members of the organization see it only once its owner has set visibility to ‘organization’. A report the caller may not read returns 404 rather than 403, so the response cannot confirm that a report with that id exists.
Authentication: SupabaseAuth, CookieAuth
Returns — id · name · visibility · url · expiresIn
Field names as the handler returns them; the source states no types for them.
Effect — reads pdf_reports
Parameters
| Name | In | Required | Type | Notes |
|---|---|---|---|---|
id |
path | yes | integer | |
expiresIn |
query | no | integer |
Responses
| Status | Meaning | Body |
|---|---|---|
200 |
A signed URL for the report PDF. | |
400 |
Invalid report id. | Error |
401 |
Not authenticated. | Error |
404 |
No report with that id is visible to the caller. | Error |
409 |
The report row exists but has no stored file. | Error |
500 |
Lookup or signing failed. | Error |