Fac-360
Companies

Answer a complaint, which is the act that discharges the fifteen day obligation

ADMIN and above. This is the provider speaking on the record: the constancia that they answered, which the Reglamento del Libro de Reclamaciones requires them to keep for two years alongside the complaint itself. ONE answer per complaint. Posting again CORRECTS the text and reports corrected: true, and respondedAt still reports the FIRST answer — a correction does not move the date the obligation was discharged on, or a late answer could be dressed up as punctual. It shares that implementation with the machine route, so the two doors cannot disagree. THE COMPLAINT ITSELF IS NOT EDITABLE BY ANYONE, this company included. What the consumer filed is the record; the answer goes beside it, never over it.

POST
/console/v1/companies/{companyId}/complaints/{trackingCode}/response

ADMIN and above. This is the provider speaking on the record: the constancia that they answered, which the Reglamento del Libro de Reclamaciones requires them to keep for two years alongside the complaint itself.

ONE answer per complaint. Posting again CORRECTS the text and reports corrected: true, and respondedAt still reports the FIRST answer — a correction does not move the date the obligation was discharged on, or a late answer could be dressed up as punctual. It shares that implementation with the machine route, so the two doors cannot disagree.

THE COMPLAINT ITSELF IS NOT EDITABLE BY ANYONE, this company included. What the consumer filed is the record; the answer goes beside it, never over it.

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Path Parameters

companyId*string
Formatuuid
trackingCode*string

The code the consumer received when they filed.

Match^[RQ]-[0-9]{4}-[0-9]{6}$

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/console/v1/companies/497f6eca-6276-4993-bfeb-53cbbbba6f08/complaints/string/response" \  -H "Authorization: Bearer apf_v2_tu_credencial" \  -H "Content-Type: application/json" \  -d '{    "body": "Revisamos el caso y le damos la razon: devolvemos el importe cobrado a la misma tarjeta, con un plazo de siete dias habiles para que su banco lo refleje."  }'
{  "schemaVersion": "console.1",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "trackingCode": "string",  "respondedAt": "2019-08-24T14:15:22Z",  "corrected": true}

The complaints filed against this company, and the book's own identifier GET GET

ADMIN and above, and the floor is higher than it looks for a read: this returns the personal data of THIRD PARTIES — consumers who are not this platform's users and never chose to be in it. It is the same floor the machine surface's complaints:read scope carries, so a person's role and a credential's scope cannot disagree about who may see a consumer's address. It runs on DB_RUNTIME and not on the console connection. apifact_console holds SELECT on exactly two tables and no DML anywhere, so it cannot read complaints.* and must not learn to; what it can do is prove which company this session is entitled to, which is exactly what auth.bind_console_company is for. The book's own identifier comes back with the list, because the person reading this screen is usually the person who has to put it on the company's website. requiresTurnstile says whether that form is expected to send a humanity token. A refusal is 403 CONSOLE_ROLE_INSUFFICIENT and never 401: the session is alive and only the role is short, and a 401 would send somebody to a login screen that cannot fix it.

The certificate versions this company has enrolled GET GET

ADMIN and above. Status and validity only: no storage location and no secret, because this route reads through the same repository the machine surface uses and that repository cannot read an envelope's location at all.