clinicpro/docs/api/secretary.md

Secretary API

Prefix: /api/v1/secretary, /api/v1/secretaries

Secretaries are linked to a doctor and have granular permissions controlling what they can do on behalf of the doctor.

---

POST /api/v1/secretary

Create a secretary for a doctor.

Permission: ROLE_DOCTOR — must own the doctor profile

Request Body (application/json)

{
  "doctor_uuid": "550e8400-...",
  "mobile_number": "09123456789",
  "password": "secretaryPass123",
  "permissions": {
    "version": 1,
    "resources": {
      "appointments": { "view": true, "create": true, "cancel": false, "update_status": true },
      "addresses":    { "view": true, "create": false, "update": false, "delete": false },
      "clinic_info":  { "view": true, "update": false },
      "insurances":   { "view": true, "create": false, "update": false, "delete": false }
    }
  }
}

Field	Type	Required	Description
doctor_uuid	string (UUID)	✅	Doctor to assign secretary to
mobile_number	string	✅	Secretary's login mobile
password	string	❌	Initial password (auto-generated if omitted)
permissions	object	❌	Permission set (see structure below)

Permissions Structure:

{
  "version": 1,
  "resources": {
    "appointments": {
      "view":          true,   // Can view appointments list
      "create":        true,   // Can book appointments
      "cancel":        false,  // Can cancel appointments
      "update_status": true    // Can mark as completed/no_show
    },
    "addresses": {
      "view":   true,
      "create": false,
      "update": false,
      "delete": false
    },
    "clinic_info": {
      "view":   true,
      "update": false
    },
    "insurances": {
      "view":   true,
      "create": false,
      "update": false,
      "delete": false
    }
  }
}

Response 201

{
  "success": true,
  "data": {
    "uuid": "sec-uuid-...",
    "mobile_number": "09123456789",
    "active": true,
    "permissions": { ... },
    "doctor": { "uuid": "...", "title": "دکتر علی احمدی" },
    "created_at": 1717000000
  }
}

Errors

Code	HTTP	Description
ERR_AUTH_001	401	Missing token
ERR_AUTH_006	403	Not a doctor or not the doctor's owner
ERR_NOT_FOUND_001	404	Doctor not found
ERR_CONFLICT_001	409	Mobile number already in use
ERR_SECRETARY_001	422	Plan limit for secretaries reached

---

GET /api/v1/secretary/{uuid}

Get secretary detail.

Permission: AUTH — must be the linked doctor or ROLE_ADMIN

Path Parameters

Param	Type	Description
uuid	string (UUID)	Secretary UUID

Response 200

{
  "success": true,
  "data": {
    "uuid": "...",
    "mobile_number": "09123456789",
    "active": true,
    "permissions": { ... },
    "doctor": { "uuid": "...", "title": "دکتر علی احمدی" },
    "created_at": 1717000000
  }
}

Errors

Code	HTTP	Description
ERR_AUTH_001	401	Missing token
ERR_FORBIDDEN_001	403	Not authorized
ERR_NOT_FOUND_001	404	Secretary not found

---

PATCH /api/v1/secretary/{uuid}

Update secretary active status or permissions.

Permission: ROLE_DOCTOR — must be the linked doctor

Request Body (application/json)

{
  "active": false,
  "permissions": {
    "version": 1,
    "resources": {
      "appointments": { "view": true, "create": false, "cancel": false, "update_status": false }
    }
  }
}

Field	Type	Required	Description
active	boolean	❌	Enable/disable secretary
permissions	object	❌	New permissions object

Response 200

Updated secretary object.

Errors

Code	HTTP	Description
ERR_AUTH_001	401	Missing token
ERR_FORBIDDEN_001	403	Not the linked doctor
ERR_NOT_FOUND_001	404	Secretary not found

---

DELETE /api/v1/secretary/{uuid}

Delete a secretary.

Permission: ROLE_DOCTOR — must be the linked doctor

Response 200

{ "success": true, "data": { "message": "منشی حذف شد" } }

Errors

Code	HTTP	Description
ERR_AUTH_001	401	Missing token
ERR_FORBIDDEN_001	403	Not the linked doctor
ERR_NOT_FOUND_001	404	Secretary not found

---

GET /api/v1/secretaries/{doctorUuid}

Get all secretaries for a specific doctor.

Permission: AUTH — must be the doctor or ROLE_ADMIN

Path Parameters

Param	Type	Description
doctorUuid	string (UUID)	Doctor UUID

Response 200

{
  "success": true,
  "data": [
    {
      "uuid": "...",
      "mobile_number": "09...",
      "active": true,
      "permissions": { ... },
      "created_at": 1717000000
    }
  ]
}

Errors

Code	HTTP	Description
ERR_AUTH_001	401	Missing token
ERR_FORBIDDEN_001	403	Not the doctor
ERR_NOT_FOUND_001	404	Doctor not found