Fixed tenant management

Create Organisation Fix
Added GEMINI.md file
2026-10-20 17:56:04 +02:00 · 2026-10-20 12:47:06 +02:00 · 2026-10-19 10:54:11 +02:00 · 2026-10-11 11:16:08 +02:00 · 2026-10-11 08:29:30 +02:00 · 2026-10-11 08:17:21 +02:00
471 changed files with 137867 additions and 16974 deletions
@@ -0,0 +1,21 @@
+# Exclude build output and caches
+**/bin/
+**/obj/
+**/out/
+.vs/
+.vscode/
+
+# Exclude git internal files
+.git/
+.gitignore
+
+# Exclude local environment/secret files
+.env
+*.env
+*.user
+*.suo
+
+# Exclude node modules and temporary logs
+**/node_modules/
+**/dist/
+*.log
@@ -11,6 +11,8 @@
 *.sln.docstates
 *.env
 *.env.json
+certificates/
+package-lock.json

 # User-specific files (MonoDevelop/Xamarin Studio)
 *.userprefs
@@ -51,6 +53,8 @@ bld/

 # Build results on 'Bin' directories
 **/[Bb]in/*
+dist/assets/
+dist/
 # Uncomment if you have tasks that rely on *.refresh files to move binaries
 # (https://github.com/github/gitignore/pull/3736)
 #!**/[Bb]in/*.refresh
@@ -58,8 +62,7 @@ bld/
 # Visual Studio 2015/2017 cache/options directory
 .vs/
 .vscode/
-bin/
-certificates/
+
 # Uncomment if you have tasks that create the project's static files in wwwroot
 #wwwroot/

@@ -347,6 +350,7 @@ _Pvt_Extensions

 # Paket dependency manager
 **/.paket/paket.exe
+**/.paket/paket.exe
 paket-files/

 # FAKE - F# Make
@@ -432,3 +436,9 @@ FodyWeavers.xsd
 *.msix
 *.msm
 *.msp
+/PostFundManagement.ConsoleUI/dist/config.json
+/PostFundManagement.ConsoleUI/dist/env-config.js
+/PostFundManagement.ConsoleUI/dist/assets/index-BaOzkVJi.css
+/PostFundManagement.ConsoleUI/dist/assets/index-BU8qSe7k.js
+/PostFundManagement.ConsoleUI/dist/favicon.svg
+/PostFundManagement.ConsoleUI/dist/index.html
@@ -1,28 +0,0 @@
-FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS base
-WORKDIR /app
-EXPOSE 80
-EXPOSE 443
-
-FROM node:22-bookworm-slim AS node
-
-FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
-ARG TARGETARCH
-ENV DOTNET_CLI_TELEMETRY_OPTOUT=1 \
-    NUGET_XMLDOC_MODE=skip
-WORKDIR /app_source
-
-COPY . .
-
-RUN dotnet restore "PostFundManagement.slnx"
-
-WORKDIR "/app_source/PostFundManagement.Api"
-RUN dotnet build "PostFundManagement.Api.csproj" -c Release -o /app/build
-
-FROM build AS publish
-RUN dotnet publish "PostFundManagement.Api.csproj" -c Release --no-restore -o /app/publish
-
-FROM base AS final
-WORKDIR /app
-COPY --from=publish /app/publish .
-ENV ASPNETCORE_FORWARDEDHEADERS_ENABLED=true
-ENTRYPOINT ["dotnet", "PostFundManagement.Api.dll"]
@@ -0,0 +1,36 @@
+# Stage 1: Runtime base
+FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS base
+USER app
+WORKDIR /app
+EXPOSE 8080
+
+# Stage 2: Build & Restore
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+
+# Copy csproj files for layer caching
+COPY ["PostFundManagement.Api/PostFundManagement.Api.csproj", "PostFundManagement.Api/"]
+COPY ["PostFundManagement.Application/PostFundManagement.Application.csproj", "PostFundManagement.Application/"]
+COPY ["PostFundManagement.Domain/PostFundManagement.Domain.csproj", "PostFundManagement.Domain/"]
+COPY ["PostFundManagement.Infrastructure/PostFundManagement.Infrastructure.csproj", "PostFundManagement.Infrastructure/"]
+
+# Restore packages
+RUN dotnet restore "PostFundManagement.Api/PostFundManagement.Api.csproj"
+
+# Copy full source code
+COPY . .
+
+# Build from the project folder using relative filename
+WORKDIR "/src/PostFundManagement.Api"
+RUN dotnet build "PostFundManagement.Api.csproj" -c Release -o /app/build
+
+# Stage 3: Publish
+FROM build AS publish
+ARG BUILD_CONFIGURATION=Release
+RUN dotnet publish "PostFundManagement.Api.csproj" -c Release -o /app/publish /p:UseAppHost=false
+
+# Stage 4: Final Runtime
+FROM base AS final
+WORKDIR /app
+COPY --from=publish /app/publish .
+ENTRYPOINT ["dotnet", "PostFundManagement.Api.dll"]
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Communications;

@@ -14,20 +12,21 @@ public sealed class GetApplicantInviteEndpoint : IEndpoint
 {
    public void Map(IEndpointRouteBuilder builder)
    {
-        builder.MapGet("api/communications/invites/applicant/{applicantUserId:Guid}", async (Guid applicantUserId, ICommunicationsService service,
+        builder.MapGet("api/communications/invites/applicants/{applicantUserId:Guid}", async (Guid applicantUserId, ICommunicationsService service,
            HttpContext context, CancellationToken cancellationToken = default) =>
                await service.GetApplicantInviteAsync(applicantUserId, cancellationToken) switch
                {
                    {  IsSuccess: true, Value: var invite } => Results.Ok(invite),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Gets an applicant's invite")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetApplicantInviteEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Invite>(StatusCodes.Status200OK)        
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Communications)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Communications;

@@ -19,15 +17,16 @@ public sealed class GetApplicantInvitesEndpoint : IEndpoint
                await service.GetApplicantInvitesAsync(applicantUserId, cancellationToken) switch
                {
                    {  IsSuccess: true, Value: var invite } => Results.Ok(invite),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Gets an applicant's invite list")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetApplicantInvitesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Invite[]>(StatusCodes.Status200OK)        
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Communications)
            .CacheOutput();
@@ -0,0 +1,35 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Communications;
+
+[ApiVersionTarget(1)]
+public sealed class GetIApplicantDataEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/communications/applicants/{applicantUserId:Guid}/all", async (Guid applicantUserId, 
+            ICommunicationsService service, CancellationToken cancellationtToken = default ) =>
+                await service.GetApplicantDataAsync(applicantUserId, cancellationtToken) switch
+                {
+                    { IsSuccess: true, Value: var applicantData } => Results.Ok(applicantData),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Gets an applicant's data")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetIApplicantDataEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Invite>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Communications)
+            .CacheOutput();
+    }
+}
@@ -4,9 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using static PostFundManagement.Application.Extensions.General;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Communications;

@@ -23,6 +20,7 @@ public sealed class GetInvitesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of sent invitations")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetInvitesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Invite[]>(StatusCodes.Status200OK)
@@ -0,0 +1,35 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Communications;
+
+[ApiVersionTarget(1)]
+public sealed class GetNotificationsEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/communications/notifications/{organisationId}", async (string organisationId, 
+            ICommunicationsService service, CancellationToken cancellationToken = default) =>
+                await service.GetNotificationsAsync(organisationId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var notifications } => Results.Ok(notifications),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Retrieves the notification system report")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetNotificationsEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Notification[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Notification[]>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Communications)
+            .CacheOutput();
+    }
+}
@@ -5,8 +5,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Communications;

@@ -15,19 +13,22 @@ public sealed class SendInviteEndpoint : IEndpoint
 {
    public void Map(IEndpointRouteBuilder builder)
    {
-        builder.MapPost("api/communications/invite", async (InviteRequest request,
+        builder.MapPost("api/communications/invites", async (InviteRequest request,
            HttpContext context, ICommunicationsService service, CancellationToken cancellationToken = default) =>
                await service.SendInviteAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true, Value: var invite } => Results.Ok(invite),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Trigger an invite to an organization or candidate (specifying NotificationPlatform)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(SendInviteEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Invite>(StatusCodes.Status200OK)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .Produces(StatusCodes.Status401Unauthorized)
            .WithTags(EndpointTags.Communications);
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -34,9 +32,9 @@ public class CreateEvidenceEndpoint : IEndpoint
                var r => Results.InternalServerError(r.Errors.ToProblems())
            };
        })
-        .RequireAuthorization()
-        .DisableAntiforgery()
        .WithDescription("Upload supporting evidence file to S3 and register metadata (M14)")
+        .DisableAntiforgery()
+        .RequireAuthorization(Constants.MainScope)
        .WithName(typeof(CreateEvidenceEndpoint).ToEndpointName())
        .MapToApiVersion(new ApiVersion(1))
        .Produces(StatusCodes.Status200OK)
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Evidence;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -19,16 +17,17 @@ public class CreateIndicatorEndpoint : IEndpoint
                await service.CreateIndicatorAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Define indicators and baselines/targets (M08)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateIndicatorEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence);
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Evidence;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -19,16 +17,18 @@ public class CreateMilestoneEndpoint : IEndpoint
                await service.CreateMilestoneAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Define contractual milestones (M07)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateMilestoneRequest).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence);
    }
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -19,16 +17,17 @@ public sealed class GetEvidenceEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var evidence } => Results.Ok(evidence),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific evidence record and assiciated file URLs")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetEvidenceEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Evidence>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces(StatusCodes.Status403Forbidden)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence)
            .CacheOutput();
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -21,6 +19,7 @@ public class GetEvidenceFilesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of all uploaded evidence files metadata")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetEvidenceFilesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Evidence[]>(StatusCodes.Status200OK)
@@ -0,0 +1,35 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Evidence;
+
+[ApiVersionTarget(1)]
+public sealed class GetEvidenceUrlEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/evidence/{evidenceId}/securelink", async (string evidenceId, IEvidenceService service, 
+            CancellationToken cancellationToken = default) =>
+                await service.GetEvidenceUrlAsync(evidenceIdHash: evidenceId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var evidenceUrl } => Results.Ok(evidenceUrl),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets a secure download URL of the evidence file, URL expires (default: 15min)")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetEvidenceUrlEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<string>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Grants)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -20,16 +18,17 @@ public sealed class GetIndicatorEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var indicator } => Results.Ok(indicator),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific indicator.")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetIndicatorEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Indicator>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces(StatusCodes.Status403Forbidden)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -22,6 +20,7 @@ public class GetIndicatorsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Get a list of indicators")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetIndicatorsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Indicator[]>(StatusCodes.Status200OK)
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -22,6 +20,7 @@ public class GetMilestoneEvidenceEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of all uploaded evidence metadata for a specific mliestone")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetMilestoneEvidenceEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Evidence[]>(StatusCodes.Status200OK)        
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -22,6 +20,7 @@ public class GetProjectEvidenceEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Get a list of all uploaded evidence metadata for a specific project")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProjectEvidenceEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Evidence[]>(StatusCodes.Status200OK)        
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -23,6 +21,7 @@ public class RecordIndicatorAmountEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Record actual values for indicators (M08)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(RecordIndicatorAmountEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Evidence;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -19,17 +17,19 @@ public sealed class UpdateEvidenceEndpoint : IEndpoint
                await service.UpdateEvidenceAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Updates a specific evidence record metadata")
+            .RequireAuthorization(Constants.MainScope)
+            .DisableAntiforgery()
            .WithName(typeof(UpdateEvidenceEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence);
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -23,6 +21,7 @@ public class ApproveDisbursementEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Approve disbursement and release payment (M06)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(ApproveDisbursementEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Execution;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -19,17 +17,18 @@ public class CreateDisbursementEndpoint : IEndpoint
                await service.CreateDisbursementAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Create a new disbursement schedule (M06)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateDisbursementEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Execution);
    }
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Execution;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -19,17 +17,18 @@ public class CreateRiskEndpoint : IEndpoint
                await service.CreateRiskAsync(request, context.GetUserId(), cancellationToken) switch 
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Add risk to risk register (M09)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateRiskEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Execution);
    }
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Execution;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Execution;
+
+[ApiVersionTarget(1)]
+public sealed class CreateRuleEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/execution/rules", async (CreateRuleRequest request, HttpContext context,
+            IExecutionService service, CancellationToken cancellationToken = default) =>
+                await service.CreateRuleAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Add rule against a programme")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateRuleEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Execution);
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -20,16 +18,17 @@ public sealed class GetDisbursementEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var disbursement } => Results.Ok(disbursement),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific disbursement")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetDisbursementEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Disbursement>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Execution)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -22,6 +20,7 @@ public class GetDisbursementsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of disbursements")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetDisbursementsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Disbursement[]>(StatusCodes.Status200OK)
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -20,15 +18,16 @@ public sealed class GetRiskEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var risk  } => Results.Ok(risk),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific risk")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetRiskEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Risk>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Execution)
            .CacheOutput();
@@ -3,8 +3,7 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;
+using PostFundManagement.Domain.Models;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -21,9 +20,10 @@ public class GetRisksEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of all risks")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetRisksEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
+            .Produces<Risk[]>(StatusCodes.Status200OK)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Execution)
@@ -0,0 +1,35 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Execution;
+
+[ApiVersionTarget(1)]
+public sealed class GetRuleEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/execution/rules/{ruleId}", async (string ruleId, IExecutionService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetRuleAsync(ruleId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var rules } => Results.Ok(rules),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Get a specific programme rule")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetRuleEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Rule>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Execution)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,32 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Execution;
+
+[ApiVersionTarget(1)]
+public sealed class GetRulesEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/execution/programmes/rules", async (Pagination pagination, IExecutionService service, 
+            CancellationToken cancellationToken = default) =>
+                await service.GetRulesAsync(pagination, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var rules } => Results.Ok(rules),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Get a list of all programme rules")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetRulesEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Rule[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Execution)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Execution;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -23,6 +21,7 @@ public sealed class UpdateDisbursementEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Update the details of a specific disbursement")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(UpdateDisbursementEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Execution;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -23,6 +21,7 @@ public sealed class UpdateRiskEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Update the details of a specific risk")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(UpdateRiskEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -0,0 +1,33 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Execution;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Execution;
+
+[ApiVersionTarget(1)]
+public sealed class UpdateRuleEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPut("api/execution/rules", async (UpdateRuleRequest request, HttpContext context,
+            IExecutionService service, CancellationToken cancellationToken = default) =>
+                await service.UpdateRuleAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Update the details of a specific programme rule (supplied version auto-increment)")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(UpdateRuleEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Execution);
+    }
+}
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Governance;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class CreateInstrumentEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/governance/instruments", async (CreateInstrumentRequest request, HttpContext context,
+            IGovernanceService service, CancellationToken cancellationToken = default) =>
+                await service.CreateInstrumentAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true} => Results.Ok(),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Creates a new programme funding instrument")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateInstrumentEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -19,10 +17,12 @@ public sealed class CreateOrganisationEndpoint : IEndpoint
                await service.CreateOrganisationAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Create a new organization profile")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateOrganisationEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -25,6 +23,7 @@ public sealed class CreatePortfolioEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Create a new organization portfolio")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreatePortfolioEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Governance;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class CreateTenantEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/governance/tenants", async (CreateTenantRequest request, IGovernanceService service, HttpContext context,
+            CancellationToken cancellationToken = default) =>
+                await service.CreateTenantAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Create a new tenant")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateTenantEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)                        
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance);
+    }
+}
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -21,6 +19,7 @@ public class DashboardEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get executive portfolio dashboard metrics and KPIs")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(DashboardEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Dashboard>(StatusCodes.Status200OK)
@@ -0,0 +1,33 @@
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Shared;
+using PostFundManagement.Domain;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class GetAuditLogsEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/governance/auditlog", async (Pagination pagination, AuditService service, 
+            CancellationToken cancellationToken = default) =>
+                await service.GetAuditLogsAsync(pagination, cancellationToken) switch
+                {
+                    {  IsSuccess: true, Value: var logs } => Results.Ok(logs),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Retrieves audit logs based on pagination parameters")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetAuditLogsEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<AuditLog[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -18,11 +16,12 @@ public class GetInstrumentsEndpoint : IEndpoint
            CancellationToken cancellationToken = default) =>
                await service.GetInstrumentsAsync(programmeId, cancellationToken) switch
                {
-                    { IsSuccess: true, Value: var instrumenrs } => Results.Ok(instrumenrs),
+                    { IsSuccess: true, Value: var instruments } => Results.Ok(instruments),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Get all funding instruments")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetInstrumentsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Instrument[]>(StatusCodes.Status200OK)
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -20,16 +18,17 @@ public class GetOrganisationEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var organisation } => Results.Ok(organisation),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get organization profile by ID")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetOrganisationEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Organisation>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces(StatusCodes.Status403Forbidden)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Governance)
            .CacheOutput();
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public class GetOrganisationPortfoliosEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/organisations/{organisationId}/portfolio", async (string organisationId,
+            IGovernanceService service, CancellationToken cancellationToken = default) =>
+                await service.GetOrganisationPorfoliosAsync(organisationId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var portfolios } => Results.Ok(portfolios),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Get all portfolios belonging to a specific organisation")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetOrganisationPortfoliosEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Portfolio[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -22,6 +20,7 @@ public class GetOrganisationsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a paginated directory of organizations")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetOrganisationsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Organisation[]>(StatusCodes.Status200OK)
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class GetPorfolioValueEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/portfolios/{portfolioId}/value", async (string portfolioId, IGovernanceService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetPorfolioValueAsync(portfolioId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var amount } => Results.Ok(amount),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Calculates and returns a portfolio's total project's budget value")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetPorfolioValueEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<decimal>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -19,16 +17,17 @@ public sealed class GetPortfolioEndpoint : IEndpoint
                await service.GetPortfolioAsync(portfolioIdHash: portfolioId, cancellationToken) switch
                {
                    {  IsSuccess: true, Value: var portfolio } => Results.Ok(portfolio),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific portfolios")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetPortfolioEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Portfolio[]>(StatusCodes.Status200OK)
-            .Produces<Portfolio[]>(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Governance)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -19,17 +17,18 @@ public sealed class GetPortfolioProgrammesEndpoint : IEndpoint
                await service.GetPortfolioProgrammesAsync(portfolioId, cancellationToken) switch
                {
                    { IsSuccess: true, Value: var portfolios } => Results.Ok(portfolios),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a programme's portfolios")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetPortfolioProgrammesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Programme[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Governance)
            .CacheOutput();
@@ -1,28 +1,26 @@
-using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

 [ApiVersionTarget(1)]
-public class GetPortfoliosEndpoint : IEndpoint
+public sealed class GetPortfoliosEndpoint : IEndpoint
 {
    public void Map(IEndpointRouteBuilder builder)
    {
-        builder.MapGet("api/governance/organisations/{organisationId}/portfolio", async (string organisationId,
-            IGovernanceService service, CancellationToken cancellationToken = default) =>
-                await service.GetPorfoliosAsync(organisationId, cancellationToken) switch
+        builder.MapPost("api/governance/organisations/portfolios", async (Pagination pagination, IGovernanceService service, 
+            CancellationToken cancellationToken = default) =>
+                await service.GetPorfoliosAsync(pagination, cancellationToken) switch
                {
                    { IsSuccess: true, Value: var portfolios } => Results.Ok(portfolios),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get all portfolios")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetPortfoliosEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Portfolio[]>(StatusCodes.Status200OK)
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class GetProgrammeValueEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/programmes/{programmeId}/value", async (string programmeId, IGovernanceService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetProgrammeValueAsync(programmeId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var amount } => Results.Ok(amount),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Calculates and returns a programme's total project budget value")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetProgrammeValueEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<decimal>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -23,6 +21,7 @@ public class GetProgrammesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get all programmes")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProgrammesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Programme[]>(StatusCodes.Status200OK)
@@ -0,0 +1,35 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class GetTenantEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/tenants/{tenantId}", async (string tenantId, IGovernanceService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetTenantAsync(tenantId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var tenant } => Results.Ok(tenant),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets a single tenant")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetTenantsEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Tenant>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance);
+    }
+}
@@ -0,0 +1,33 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class GetTenantOrganisationsEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/tenants/{tenantIdHash}/organisations", async (IGovernanceService service, string tenantIdHash,
+            CancellationToken cancellationToken = default) =>
+                await service.GetTenantOrganisationsAsync(tenantIdHash, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var tenantOrganisations } => Results.Ok(tenantOrganisations),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets organisations created and managed by one tenant")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetTenantOrganisationsEndpoint).ToEndpointName("Retrieval"))
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<TenantOrganisation[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance);
+    }
+}
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class GetTenantUsersEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/tenants/{tenantIdHash}/users", async (IGovernanceService service, string tenantIdHash,
+            CancellationToken cancellationToken = default) =>
+                await service.GetTenantUsersAsync(tenantIdHash, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var tenantUsers } => Results.Ok(tenantUsers),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets users created and managed by one tenant")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetTenantUsersEndpoint).ToEndpointName("Retrieval"))
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<TenantUser[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance);
+    }
+}
+
@@ -0,0 +1,30 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Entities;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class GetTenantsEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/tenants", async (IGovernanceService service, 
+            CancellationToken cancellationToken = default) =>
+                await service.GetTenantsAsync(cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var tenants } => Results.Ok(tenants),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets system tenants")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetTenantsEndpoint).ToEndpointName("Retrieval"))
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Tenant[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance);
+    }
+}
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Governance;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class UpdateInstrumentEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPut("api/governance/instruments", async (UpdateInstrumentRequest request, HttpContext context,
+            IGovernanceService service, CancellationToken cancellationToken = default) =>
+                await service.UpdateInstrumentAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Updates a programme funding instrument")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(UpdateInstrumentEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -15,21 +13,24 @@ public sealed class UpdateOrganisationEndpoint : IEndpoint
    public void Map(IEndpointRouteBuilder builder)
    {
        builder.MapPut("api/governance/organisations", async (UpdateOrganisationRequest request,
-            IGovernanceService service, CancellationToken cancellationToken = default) => 
-                await service.UpdateOrganisationAsync(request, cancellationToken) switch
+            IGovernanceService service, HttpContext context, CancellationToken cancellationToken = default) =>
+                await service.UpdateOrganisationAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Update an existing organization profile")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(UpdateOrganisationEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces(StatusCodes.Status401Unauthorized)
            .WithTags(EndpointTags.Governance);
    }
 }
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -25,6 +23,7 @@ public sealed class UpdatePortfolioEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Update an existing organization portfolio")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(UpdatePortfolioEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Governance;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class UpdateTenantEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPut("api/governance/tenants", async (UpdateTenantRequest request, HttpContext context, 
+            IGovernanceService service, CancellationToken cancellationToken = default) =>
+                await service.UpdateTenantAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Updates a specific tenant")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(UpdateTenantEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance);
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -19,17 +17,18 @@ public class CreateAwardEndpoint : IEndpoint
                await service.CreateAwardAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Register an approved funding award (M01)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateAwardEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Grants);
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -20,16 +18,17 @@ public class CreateBudgetEndpoint : IEndpoint
                {
                    {  IsSuccess: true } => Results.Ok(),
                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
-                    var r when r.HasError<CreateError>() => Results.BadRequest(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Create a new budget line (M05)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateBudgetEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .Produces(StatusCodes.Status401Unauthorized)
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -19,15 +17,17 @@ public class CreateContractEndpoint : IEndpoint
                await service.CreateContractAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Create a contract record from an approved award (M02)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateContractEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .Produces(StatusCodes.Status401Unauthorized)
            .WithTags(EndpointTags.Grants);
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -23,6 +21,7 @@ public class ExecuteContractEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Execute the contract and lock the contractual version")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(ExecuteContractEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -20,16 +18,17 @@ public class GetAwardEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var award } => Results.Ok(award),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get award by ID")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetAwardEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Award>(StatusCodes.Status200OK)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Grants)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -22,6 +20,7 @@ public class GetAwardsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of awards")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetAwardsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Award[]>(StatusCodes.Status200OK)
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -20,14 +18,15 @@ public class GetBudgetEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var budget } => Results.Ok(budget),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get budget by ID")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetBudgetEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Budget>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -22,6 +20,7 @@ public class GetBudgetsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get all budgets")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetBudgetsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Budget[]>(StatusCodes.Status200OK)
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -20,14 +18,15 @@ public class GetContractEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var contract } => Results.Ok(contract),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get contract by ID")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetContractEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Contract>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
@@ -0,0 +1,35 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Grants;
+
+[ApiVersionTarget(1)]
+public sealed class GetContractUrlEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/grants/contracts/{contractId}/securelink", async (string contractId, IGrantsService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetContractUrlAsync(contractId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var contractUrl} => Results.Ok(contractUrl),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets a secure download URL, has expiry period (default 15min)")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetContractUrlEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<string>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Grants)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -22,6 +20,7 @@ public class GetContractsEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get all contracts")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetContractsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Contract[]>(StatusCodes.Status200OK)
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Grants;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Grants;
+
+[ApiVersionTarget(1)]
+public sealed class UpdateBudgetEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPut("api/grants/budgets", async (UpdateBudgetRequest request, HttpContext context,
+            IGrantsService service, CancellationToken cancellationToken = default) =>
+                await service.UpdateBudgetAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Updates a specific budget")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(UpdateBudgetEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)            
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,37 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Grants;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Grants;
+
+[ApiVersionTarget(1)]
+public sealed class UpdateContractEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPut("api/grants/contracts", async (UpdateContractRequest request, IGrantsService service,
+            CancellationToken cancellationToken = default) =>
+                await service.UpdateContractAsync(request, cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Updates a specific contract")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(UpdateContractEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Grants)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,45 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Grants;
+
+[ApiVersionTarget(1)]
+public sealed class UploadContractEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/grants/contracts/{contractId}", async (string contractId, HttpRequest request, IGrantsService service, 
+            CancellationToken cancellationToken = default) =>
+        {
+            if (!request.HasFormContentType)
+                return Results.BadRequest("Request must be a multipart form.");
+
+            var form = await request.ReadFormAsync(cancellationToken);
+            var file = form.Files.GetFile("file");
+
+            if (file == null || file.Length == 0)
+                return Results.BadRequest("No file uploaded or file is empty.");
+
+            return await service.UploadContractAsync(contractId, request.HttpContext.GetUserId(), file, cancellationToken) switch
+            {
+                { IsSuccess: true } => Results.Ok(),
+                var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                var r => Results.InternalServerError(r.Errors.ToProblems())
+            };
+        })
+        .WithDescription("Uploads a contract file securely")
+        .RequireAuthorization(Constants.MainScope)
+        .DisableAntiforgery()
+        .WithName(typeof(UploadContractEndpoint).ToEndpointName())
+        .MapToApiVersion(new ApiVersion(1))
+        .Produces(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status403Forbidden)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .WithTags(EndpointTags.Grants)
+        .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Projects;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -19,14 +17,16 @@ public class CreateActivityEndpoint : IEndpoint
                await service.CreateActivityAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } result => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
+            .RequireAuthorization(Constants.MainScope)
            .WithDescription("Add a new activity under project (M04)")
            .WithName(typeof(CreateActivityEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .Produces(StatusCodes.Status401Unauthorized)
@@ -0,0 +1,33 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Projects;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class CreateBeneficiaryEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/projects/beneficiaries", async (CreateBeneficiaryRequest request, HttpContext context,
+            IProjectService service, CancellationToken cancellationToken = default) =>
+                await service.CreateBeneficiaryAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Add a new project beneficiary")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateBeneficiaryEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .WithTags(EndpointTags.Projects);
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Projects;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class CreateChangeRequestEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/projects/changerequests", async (CreateChangeRequest request, IProjectService service,
+            HttpContext context, CancellationToken cancellationToken = default) =>
+                await service.CreateChangeRequestAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Create a new change request against an existing project")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateChangeRequestEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects);
+    }
+}
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Projects;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class CreateComplianceItemEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/projects/complianceitems", async (CreateComplianceItemRequest request, HttpContext context,
+            IProjectService service, CancellationToken cancellationToken = default) => 
+                await service.CreateComplianceItemAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    {  IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Add a new beneficiary compliance item")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateComplianceItemEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .WithTags(EndpointTags.Projects);
+    }
+}
@@ -0,0 +1,33 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Projects;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class CreateIssueEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/projects/issues", async (CreateIssueRequest request, HttpContext context,
+            IProjectService service, CancellationToken cancellationToken = default) =>
+                await service.CreateIssueAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Add a new project issue")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateIssueEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .WithTags(EndpointTags.Projects);
+    }
+}
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Projects;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class CreateOutcomeEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/projects/beneficiaris/outcomes", async (CreateOutcomeRequest request, HttpContext context,
+            IProjectService service, CancellationToken cancellationToken = default) =>
+                await service.CreateOutcomeAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Add a new beneficiary outcome")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateOutcomeEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .WithTags(EndpointTags.Projects);
+    }
+}
+  
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Projects;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -19,18 +17,19 @@ public sealed class CreateProgrammeEndpoint : IEndpoint
                await service.CreateProgrammeAsync(request, userId: context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Create programme")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateProgrammeEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Projects);
    }
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Projects;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -19,18 +17,19 @@ public class CreateProjectEndpoint : IEndpoint
                await service.CreateProjectAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } result => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Create a new project (M04)")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(CreateProjectEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .WithTags(EndpointTags.Projects);
    }
@@ -0,0 +1,33 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Projects;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class CreateSiteVisitEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/projects/sitevisits", async (CreateSiteVisitRequest request, HttpContext context,
+            IProjectService service, CancellationToken cancellationToken = default) =>
+                await service.CreateSiteVisitAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Add a new project site visit")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateSiteVisitEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .WithTags(EndpointTags.Projects);
+    }
+}
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -22,6 +20,7 @@ public class GetActivitiesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of activities for a project")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetActivitiesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Activity[]>(StatusCodes.Status200OK)
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -19,16 +17,17 @@ public class GetActivityEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var activity } => Results.Ok(activity),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Gets a specific activity by it's id")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetActivityEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Activity>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Projects)
            .CacheOutput();
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetBeneficiariesEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/{projectId}/beneficiaries", async (string projectId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetBeneficiariesAsync(projectId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var beneficiaries } => Results.Ok(beneficiaries),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets project beneficiaries")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetBeneficiariesEndpoint).ToEndpointName("Retrieval"))
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Beneficiary[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetBeneficiaryEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/beneficiaries/{beneficiaryId}", async (string beneficiaryId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetBeneficiaryAsync(beneficiaryId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var beneficiary } => Results.Ok(beneficiary),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets project beneficiaries")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetBeneficiariesEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Beneficiary>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetChangeRequestEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/changerequests/{changeRequestId}", async (string changeRequestId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetChangeRequestAsync(changeRequestId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var changeRequest } => Results.Ok(changeRequest),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets a specific project change request")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetChangeRequestEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<ChangeRequest>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetChangeRequestsEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/{projectId}/changerequests", async (string projectId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetChangeRequestsAsync(projectId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var changeRequests } => Results.Ok(changeRequests),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets project change requests")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetChangeRequestsEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<ChangeRequest[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetComplianceItemEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/complianceitems/{complianceItemId}", async (string complianceItemId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetComplianceItemAsync(complianceItemId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var complianceItem } => Results.Ok(complianceItem),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets a specific project compliance item")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetComplianceItemEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<ComplianceItem>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetComplianceItemsEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/{projectId}/complianceitems", async (string projectId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetComplianceItemsAsync(projectId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var complianceItems } => Results.Ok(complianceItems),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets project compliance items")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetComplianceItemsEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<ComplianceItem[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetIssueEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/issues/{issueId}", async (string issueId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetIssueAsync(issueId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var issue } => Results.Ok(issue),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets a specific project issue")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetIssueEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Issue>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetIssuesEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/{projectId}/issues", async (string projectId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetIssuesAsync(projectId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var issues } => Results.Ok(issues),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets project issues")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetIssuesEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Issue[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -20,16 +18,17 @@ public class GetMilestoneEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var milestone } => Results.Ok(milestone),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Gets a specific milestone")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetMilestoneEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Milestone>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Projects)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -22,6 +20,7 @@ public class GetMilestonesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of all milestones")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetMilestonesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Milestone[]>(StatusCodes.Status200OK)
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetOutcomeEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/outcomes/{outcomeId}", async (string outcomeId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetOutcomeAsync(outcomeId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var outcome } => Results.Ok(outcome),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets a specific project outcome")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetOutcomeEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Outcome>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetOutcomesEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/outcomes/{beneficiatyId}", async (string beneficiatyId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetOutcomesAsync(beneficiatyId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var outcomes } => Results.Ok(outcomes),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets project beneficiary outcomes")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetOutcomesEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Outcome[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -19,16 +17,18 @@ public sealed class GetProgrammeEndpoint : IEndpoint
                await service.GetProgrammeAsync(programmeId, cancellationToken) switch
                {
                    { IsSuccess: true, Value: var programme } => Results.Ok(programme),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get specific programme")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProgrammeEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Programme>(StatusCodes.Status200OK)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)            
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Projects)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -19,17 +17,18 @@ public sealed class GetProgrammeProjectsEndpoint : IEndpoint
                await service.GetProgrammeProjectsAsync(programmeId, cancellationToken) switch
                {
                    { IsSuccess: true, Value: var projects } => Results.Ok(projects),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Get a list of all projects under a programme")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProgrammeProjectsEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Project[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Projects)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -22,6 +20,7 @@ public sealed class GetProgrammesEndpoint : IEndpoint
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a list of all programmes")
+            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetProgrammesEndpoint).ToEndpointName("Projects"))
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Programme[]>(StatusCodes.Status200OK)
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
hermes	dee9098379	Fixed tenant management	2026-10-20 17:56:04 +02:00
hermes	d7a168c9fa	Create Organisation Fix	2026-10-20 12:47:06 +02:00
hermes	28a821ae91	Added GEMINI.md file	2026-10-19 10:54:11 +02:00
hermes	1142cfd94e	Implemented rbac	2026-10-11 11:16:08 +02:00
hermes	45a6c0aca0	Fixed skoruba api value assignment in docker compose	2026-10-11 08:29:30 +02:00
hermes	1b586da2ab	Fixed skoruba api address configs	2026-10-11 08:17:21 +02:00
hermes	4735551e06	Removed nontest user	2026-10-11 08:02:33 +02:00
hermes	a28caa5c69	Corrected admin security docker compose api configs	2026-10-11 08:01:33 +02:00
hermes	c3cc21f334	Refactored docker compose	2026-10-11 07:49:38 +02:00
hermes	9a0371fb08	Added skorubauserservice tests	2026-10-11 07:43:51 +02:00
hermes	381d5b7e94	Stable user lockout, role and claim calls	2026-10-10 18:14:31 +02:00
hermes	d3566c5e43	Light refactor	2026-10-10 15:44:27 +02:00
hermes	0352d154a4	Added debug only fact	2026-10-10 15:35:32 +02:00
hermes	8eca793f5f	Added skoruba user service integration test	2026-10-10 15:31:36 +02:00
hermes	343f405982	Added consolidated applicant data retrieval endpoint	2026-10-10 11:11:23 +02:00
hermes	2ee7a49122	Added user management endpoints	2026-10-10 10:12:13 +02:00
hermes	1ebd83a2f4	Removed repetetive static usings and aliases	2026-10-05 08:57:39 +02:00
hermes	da2c0f9a34	Now using global static usings on endpoints to reduce boilerplate	2026-10-05 08:33:00 +02:00
hermes	34ddfc1d73	Redesigned nav bar	2026-10-04 18:27:08 +02:00
hermes	236f6f0f9d	Refactored org modal logic	2026-10-04 18:21:48 +02:00
hermes	c9deba0427	Fixed linked user resolution	2026-10-04 18:04:36 +02:00
hermes	84a171d4a4	Added stubs for user management endpoints	2026-10-04 15:17:22 +02:00
hermes	06539236a1	Added skoruba api integration	2026-10-04 14:31:06 +02:00
hermes	b3957f4af4	Refactored org create and update models	2026-10-04 11:13:09 +02:00
hermes	d8a95f3f92	Refactored tenant organisatio listing in tenant page	2026-10-04 11:08:52 +02:00
hermes	13712be13b	Corrected boolean logic on bypass filter logic	2026-10-04 10:57:42 +02:00
hermes	681ed99fea	Fine tuned organisation onboarding and tenant management	2026-10-04 10:34:59 +02:00
hermes	5fb67df9ac	Refactored organisation entities and endpoints	2026-10-04 10:11:28 +02:00
hermes	8fed46961a	Added tenant management Applied basic access control	2026-10-04 09:13:55 +02:00
hermes	8100518549	Hardened API and catered for Partner role query filter bypass	2026-10-04 08:18:43 +02:00
hermes	8d069c2da0	Redesigned dash	2026-09-29 12:24:04 +02:00
hermes	8643b2625b	Refactored dashboard	2026-09-29 11:41:14 +02:00
hermes	c805a31824	Fixed missing dependency	2026-09-28 16:46:50 +02:00
hermes	67fa99c64a	Added dockerfile to partner ui	2026-09-28 16:33:18 +02:00
hermes	9f6c1e505b	Added partner client env var	2026-09-28 16:26:05 +02:00
hermes	c4f57b92ef	Added pfm-partner to compose file	2026-09-28 16:15:43 +02:00
hermes	7d510d9fbc	Added partner app	2026-09-28 16:13:42 +02:00
hermes	242a4c6fbb	Fixed timeline height Moved export and fixed data output Added project budget amount widget to project listing	2026-09-28 11:55:52 +02:00
hermes	891801c73d	Light projects page refactor	2026-09-28 11:45:05 +02:00
hermes	8b68f7b99c	Refactored projects and milestones page	2026-09-28 11:34:11 +02:00
hermes	93b3416d2c	Removed duplicate filter in settings page Improved Rule value handling	2026-09-28 11:10:17 +02:00
hermes	ef13117042	Added Role column to user directory	2026-09-28 10:58:02 +02:00
hermes	8eae097e8b	Corrected user role mapping	2026-09-28 10:39:32 +02:00
hermes	ea71e55e2d	Refactored UI Added Role filed to user table and endpoint implementation	2026-09-28 10:25:00 +02:00
hermes	7037ea72ca	Refactored get compliance item endpoint	2026-09-27 15:05:42 +02:00
hermes	104f01e515	fixed create site visit error	2026-09-27 14:41:08 +02:00
hermes	0d626fd84a	Fixed error handling	2026-09-27 14:35:52 +02:00
hermes	9ba48de55b	ui tweaks	2026-09-27 14:27:01 +02:00
hermes	6107de3e53	fixed new change request logic	2026-09-27 14:16:08 +02:00
hermes	df167caf55	Fixed mismatched endpoint calling	2026-09-27 14:07:44 +02:00
hermes	8afceda1cd	Fixed change management rendering error	2026-09-27 13:43:14 +02:00
hermes	c1c5641d1e	Updated api usage, corrected table designs	2026-09-27 13:31:27 +02:00
hermes	2efd2859c7	Refactored docker compose	2026-09-27 13:07:55 +02:00
hermes	dd6996bdb1	Refactored endpoints	2026-09-27 13:06:50 +02:00
hermes	1df0b97daf	Issue creation, reolution is optional	2026-09-27 12:55:29 +02:00
hermes	e6fdcf3d0d	Fixed UI inconsistencies	2026-09-27 12:04:22 +02:00
hermes	36e5d3d7c8	Added, beneficiaries, site visits and change management	2026-09-27 11:40:28 +02:00
hermes	fb27cc8c92	Removed settings page mock data and replaced with api calls	2026-09-27 10:58:08 +02:00
hermes	6ab01830f3	Added audit log endpoint	2026-09-27 10:11:56 +02:00
hermes	6e6419ab51	Revised all UIs	2026-09-26 16:36:45 +02:00
hermes	ed6e57ffa9	Added budget update Added portfolio and programme value calculator endpoints	2026-09-26 15:14:29 +02:00
hermes	6be74e9a24	Added postcss	2026-09-26 13:54:39 +02:00
hermes	2949d6218b	Implemented data export	2026-09-26 13:45:42 +02:00
hermes	15a8d8f449	Fixed portfolio retrieval	2026-09-26 12:03:47 +02:00
hermes	db07ad1a82	Added missing instrument endpoints	2026-09-26 11:20:57 +02:00
hermes	11967e3252	Fixed update organisation	2026-09-26 10:39:22 +02:00
hermes	f3a8f78144	Fixed API calls on governance page Enforced multitenancy	2026-09-26 10:28:43 +02:00
hermes	b2688867f3	Surfaced programme rules	2026-09-26 07:55:49 +02:00
hermes	0f903a58b5	Recolved endpoint name ambiguity	2026-09-25 19:06:03 +02:00
hermes	86e2bad4fe	Implemented remaining business functionality	2026-09-25 19:00:50 +02:00
hermes	1efbf9d99f	Added TenantId to mapper methods on all affected models	2026-09-25 08:20:36 +02:00
hermes	24697776d0	Refactored roganisation routines to use TenantOrganisation	2026-09-25 04:01:31 +02:00
hermes	4b806a3202	UserService refactored to integrate into TenantUser	2026-09-25 03:55:20 +02:00
hermes	26df423180	Refactored cache services	2026-09-25 03:04:37 +02:00
hermes	f39eb9d8fe	Removed tools feature	2026-09-24 16:00:06 +02:00
hermes	593219db8c	Stable run, Added remaining service implementations (stubs)	2026-09-24 15:57:33 +02:00
hermes	020bdee36f	Stable run using Multi tenancy across entire estate Audit logging and error logging active	2026-09-24 12:00:47 +02:00
hermes	8e0c099867	Stable multitenancy	2026-09-24 10:25:07 +02:00
hermes	ef134a5b3c	Implemented audit logging and automated logging	2026-09-23 05:33:16 +02:00
hermes	717b891554	Added linkage to primary tenant entities	2026-09-22 07:08:57 +02:00
hermes	91d325ce4e	Make retrieval of contract file auditable	2026-09-22 06:28:54 +02:00
hermes	3cc8514136	Added automatic audit feature	2026-09-22 06:09:51 +02:00
hermes	11311421ad	Removed ValueTask generally where not needed Removed relationships from audit log	2026-09-22 05:44:25 +02:00
hermes	f4024d563a	Implemented centralised audit logging	2026-09-21 16:32:56 +02:00
hermes	78b03b6996	Colocated entity type configurations with entities Added tenant entities and models Modified db context	2026-09-21 09:34:49 +02:00
hermes	2d0f2b494a	Test 2 reoslutions	2026-09-20 15:25:53 +02:00
hermes	d428f6e17c	Remediated test #1 results	2026-09-20 13:51:01 +02:00
hermes	5829bffaa0	Refactored UI endpoint usage	2026-09-20 08:26:06 +02:00
hermes	b703b0c64d	Added service cache feature flag Updated scheduler and moved to its own dedicated database	2026-09-18 16:11:14 +02:00
hermes	6d554d19a7	Implemented featureflag for service layer caching	2026-09-18 14:58:42 +02:00
hermes	ec777fabf8	Implemented session and account lockout management Enabled account sync control and session expiration management Applied some fixes to the govername page and project page	2026-09-18 10:19:24 +02:00
hermes	41bf9b63bf	Added dist/assets/ to gitignore	2026-09-17 07:38:52 +02:00
hermes	940630f0ed	Untracking dist files	2026-09-17 07:38:16 +02:00
hermes	6de3d30a8b	Removed package.json	2026-09-17 07:23:18 +02:00
hermes	831d57a8a0	Refactored UI and compose file	2026-09-17 07:07:05 +02:00
hermes	2d74f7f1bd	Removed docker debug code	2026-09-15 12:13:16 +02:00
hermes	ebf35d7f12	Refactored ApiVersioning service registration	2026-09-15 12:09:10 +02:00
hermes	77307f4bf0	Added OPTIONS header handling	2026-09-15 08:51:48 +02:00
hermes	464c21e41d	Added RequireCors() to RouteGroup	2026-09-15 08:44:43 +02:00
hermes	364fe65e0d	Moved .RequireAuthentication() to endpoints, removed it from EndpointGroup	2026-09-15 08:37:08 +02:00
hermes	b239c402fa	Applied configurable CORS policy to API	2026-09-15 07:29:58 +02:00
hermes	f4a1064003	Fixed UI	2026-09-14 11:43:09 +02:00
hermes	5f18478675	Debug refactor	2026-09-14 10:46:21 +02:00
hermes	e71ba99f9c	Debugs refactor	2026-09-14 10:38:25 +02:00
hermes	8de761e4e6	Fixed base image .net versions	2026-09-14 10:34:09 +02:00
hermes	ca6d04d528	Debug refactor	2026-09-14 10:33:18 +02:00
hermes	f607eaf152	Rebuilt pfm-api dockerfile	2026-09-14 10:28:48 +02:00
hermes	b631c6aa4b	Light refactor	2026-09-14 10:22:56 +02:00
hermes	cb59635882	Simplified fpm-api dockerfile	2026-09-14 10:20:42 +02:00
hermes	1cf019b3b9	Added debug code	2026-09-14 10:13:31 +02:00
hermes	0a4108d345	Changed pfm-api dockerfile paths	2026-09-14 10:10:12 +02:00
hermes	afaad43c47	Simplified dockerfile (pfm-api)	2026-09-14 10:03:45 +02:00
hermes	bccdab2ba8	Refactored compose file to assign same context to both services	2026-09-14 10:01:19 +02:00
hermes	5bdd2a5786	Fixed missing file copy	2026-09-14 09:50:03 +02:00
hermes	1acdb0ea7b	Debug refactor on dockerfile	2026-09-14 09:46:34 +02:00
hermes	2047e440d8	Added better dotnet build handling	2026-09-14 09:41:47 +02:00
hermes	1771d74b43	Added more verbosity to dotnet build	2026-09-14 09:35:03 +02:00
hermes	bad91e8090	Added .dockerignore	2026-09-14 09:25:46 +02:00
hermes	f9c0c5fe16	Added stream redirection to dotnet commands	2026-09-14 09:13:46 +02:00
hermes	43c777dfe2	Commented out pfm-console to see if the api image will build	2026-09-14 09:06:15 +02:00
hermes	5dba8d3dd4	Removed stream redirection	2026-09-13 18:15:16 +02:00
hermes	0d78affd3c	Fixed Api docker file paths	2026-09-13 18:12:49 +02:00
hermes	4bac2f58c2	Added debug code to dotnet build and publish lines	2026-09-13 18:09:38 +02:00
hermes	2a8d72963d	Moved api dockerfile to project folder	2026-09-13 18:07:32 +02:00
hermes	4b658bdfd5	Corrected compose service contexts	2026-09-13 18:01:31 +02:00
hermes	9945b773db	Fixed dockerfile paths	2026-09-13 17:55:57 +02:00
hermes	f98b102a2e	Light refactor	2026-09-13 17:51:25 +02:00
hermes	f29ac65d7c	Refactored API dockerfile	2026-09-13 17:50:08 +02:00
hermes	8450db51be	Stable API run	2026-09-13 17:39:29 +02:00
hermes	5c1e18a9a9	Added debug term	2026-09-12 12:22:24 +02:00
hermes	4f1b05bf33	Second fix	2026-09-12 12:19:15 +02:00
hermes	3db6546a2b	Light refactor	2026-09-12 12:13:52 +02:00
hermes	e270bf8db2	FROM fix	2026-09-12 12:09:58 +02:00
hermes	48dd9aaa1d	Light refactor	2026-09-12 12:08:55 +02:00
hermes	3fa9f257ba	Rewrite pfm-api docker file	2026-09-12 12:04:23 +02:00
hermes	12663a588f	Fixed publish alias	2026-09-12 11:57:58 +02:00
hermes	4738a20f80	Added error output to dotnet build line	2026-09-12 11:54:36 +02:00
hermes	7446659c0c	Added working directory switch	2026-09-12 11:49:26 +02:00
hermes	e0b1b00f63	PFM Api docker refactor	2026-09-12 11:45:07 +02:00
hermes	1c1e2b9038	Implemented missing file handling endpoints Added contract update endpoint	2026-09-12 11:26:04 +02:00