Reverted changes

Refactored sync process
Simplified lockout modals
2026-10-24 12:12:27 +02:00 · 2026-10-24 12:11:48 +02:00 · 2026-10-24 11:48:19 +02:00 · 2026-10-24 11:39:47 +02:00 · 2026-10-23 10:19:30 +02:00 · 2026-10-23 00:58:47 +02:00
485 changed files with 141855 additions and 12515 deletions
@@ -12,6 +12,7 @@
 *.env
 *.env.json
 certificates/
+package-lock.json

 # User-specific files (MonoDevelop/Xamarin Studio)
 *.userprefs
@@ -0,0 +1,192 @@
+# PostFundManagement (PFM) Platform — Architectural Specification
+
+> **Document Version**: 2.0  
+> **Target Runtimes**: .NET 10.0 (C# 13) | React 19 / TypeScript 5.8 / Vite  
+> **Scope**: System Architecture, Security Topology, RBAC Enforcement, and Maker-Checker Pattern
+
+---
+
+## 1. System Topology & Architectural Layers
+
+The PFM platform is constructed using **Clean Architecture** and **Domain-Driven Design (DDD)** principles to guarantee strict decoupling of business rules, persistence concerns, and user interfaces.
+
+```
+┌────────────────────────────────────────────────────────────────────────┐
+│                          PRESENTATION TIER                             │
+│  PostFundManagement.ConsoleUI      │  PostFundManagement.PartnerUI     │
+│  (Internal Staff & Governance)     │  (External Recipient Portal)      │
+│  React 19 + TypeScript + Vite      │  React 19 + WebGL (OGL) + Vite    │
+└───────────────────────────────────┬────────────────────────────────────┘
+                                    │ HTTPS / REST (v1/api/*) + OIDC PKCE
+┌───────────────────────────────────▼────────────────────────────────────┐
+│                             API GATEWAY                                │
+│  PostFundManagement.Api (ASP.NET Core Minimal APIs / Carter)           │
+│  Authentication: JWT Bearer + OpenTelemetry Observability              │
+└───────────────────────────────────┬────────────────────────────────────┘
+                                    │
+┌───────────────────────────────────▼────────────────────────────────────┐
+│                          APPLICATION LAYER                             │
+│  PostFundManagement.Application                                        │
+│  CQRS (Mediator), Business Validators, Domain Services, Quartz Jobs   │
+└──────────────────┬─────────────────────────────────┬───────────────────┘
+                   │                                 │
+┌──────────────────▼──────────────────┐   ┌──────────▼───────────────────┐
+│            DOMAIN LAYER             │   │    INFRASTRUCTURE LAYER      │
+│  PostFundManagement.Domain          │   │  PostFundManagement.Infrastr.│
+│  Entities, Value Objects, Enums,    │   │  PostgreSQL (EF Core 10),    │
+│  Domain Invariants, Audit Models    │   │  Skoruba STS, S3 Garage,     │
+└─────────────────────────────────────┘   │  Redis HybridCache           │
+                                          └──────────────────────────────┘
+```
+
+---
+
+## 2. Security & Identity Architecture
+
+Authentication and authorization are separated cleanly across system boundaries:
+
+* **Security Token Service (STS)**: Duende IdentityServer / Skoruba Administration (`https://sts.security.khongisa.co.za`) issues cryptographically signed JWT access tokens using OpenID Connect (OIDC) with Proof Key for Code Exchange (PKCE).
+* **Audience & Scopes**: Web clients request standard OIDC scopes (`openid`, `profile`, `roles`, `email`, `address`) along with the target API resource scope (`pfm-api-dev`).
+* **Tenant Isolation**: Every authenticated principal carries a `tenant_id` claim. Multitenant query filters in EF Core enforce cross-tenant partition boundaries at the data access layer.
+* **Partner Isolation**: Grantees and external recipients possess the `partner` role. The `ConsoleUI` enforces immediate lockout for `partner` roles, restricting external users exclusively to `PartnerUI`.
+
+---
+
+## 3. Role-Based Access Control (RBAC) Architecture
+
+PFM implements a fine-grained, claim-based RBAC model where system permissions are decomposed into **15 operational domains** and **5 progressive action capabilities**.
+
+### 3.1 Role Claims Inventory
+
+| Claim Key | Operational Domain | Functional Scope |
+| :--- | :--- | :--- |
+| `dashboard` | Executive Dashboard | Macro portfolio KPIs, disbursed capital, and ISO 31000 risk heatmap |
+| `governance` | Governance & Structure | Holding entities, funder portfolios, programmes, rules, and instruments |
+| `projects_milestones` | Projects & Milestones | Work breakdown structure (WBS), contractual milestones, and activities |
+| `grant_financials` | Grants & Financials | Statutory funding awards, budget lines, contracts, and disbursement tranches |
+| `evidence_risks` | M&E, Evidence & Risks | Deliverable evidence verification queue, indicators, and risk registers |
+| `beneficiaries` | Beneficiaries & Impact | Demographic targets, POPIA compliance items, and outcome deliverables |
+| `change_management` | Change Management | Project issues, contractual change requests, and budget variations |
+| `site_visits` | Site Visits | Physical field inspections, checklist observations, and inspector findings |
+| `settings_invites` | Settings Invites | Onboarding invitations and candidate notifications dispatch |
+| `settings_users` | Settings Users | User provisioning, role assignments, and account lockouts |
+| `settings_auditlog` | Settings Audit Log | Immutable audit ledger and system telemetry records |
+| `settings_notifications`| Settings Notifications | SMTP engines, notification channels, and dispatch telemetry |
+| `tenant_self_service` | Tenant Self-Service | Tenant profile configuration and delegated sub-user management |
+| `tenant_management` | Tenant Management | Multi-tenant directory, partition allocation, and solution ownership |
+| `unrestricted` | System Administration | Root administrative bypass across all system partitions |
+
+### 3.2 Claim Actions & Capability Hierarchy
+
+Action capabilities within a claim domain follow a strict subset hierarchy:
+
+$$\text{view} \subset \text{add} \subset \text{update} \quad \text{and} \quad \text{view} \subset \text{export}$$
+
+* **`view`**: Read-only access to entity lists, detailed records, metrics, and progress scores.
+* **`add`**: Can create new records, edit draft records, submit milestone evidence, and change workflow statuses *other than approval* (includes `view`).
+* **`update`**: Authoritative governance capability. Can execute **approval** status transitions (`Approved`, `Active` contracts) on records (includes `view` and `add`).
+* **`export`**: Can generate and download structured spreadsheets (`.xlsx`) and formal PDF reports (includes `view`).
+* **`all`**: Comprehensive authority (`view`, `add`, `update`, `export`) over the claim domain.
+
+### 3.3 Authoritative Role-to-Claims Matrix
+
+| Role | Assigned Claim Domains | Standard Capabilities | Record Approval Authority (`update`) |
+| :--- | :--- | :--- | :---: |
+| **`Admin`** | `unrestricted` | `all` | **Yes (System-wide)** |
+| **`Executive`** | `dashboard`, `governance`, `projects_milestones`, `grant_financials`, `evidence_risks`, `tenant_self_service` | `all` | **Yes** |
+| **`Manager`** | `dashboard`, `projects_milestones`, `grant_financials`, `evidence_risks`, `beneficiaries`, `change_management`, `site_visits`, `settings_invites`, `settings_users`, `settings_auditlog`, `settings_notifications`, `tenant_self_service` | `all` | **Yes** |
+| **`Supervisor`** | `dashboard`, `projects_milestones`, `grant_financials`, `evidence_risks`, `beneficiaries`, `change_management`, `site_visits`, `settings_invites`, `settings_users` | `view, add, update, export`<br>*(Dashboard: `view, export`)* | **Yes** |
+| **`Contributor`** | `projects_milestones`, `grant_financials`, `evidence_risks`, `beneficiaries`, `change_management`, `site_visits`, `settings_invites` | **`view, add`** | ❌ **Strictly Prohibited** |
+
+---
+
+## 4. Maker-Checker Pattern Architecture
+
+To eliminate fraud risk, self-dealing, and conflicts of interest, PFM enforces the **Maker-Checker Pattern** (Segregation of Duties / Dual Authorization).
+
+### 4.1 Core Principle
+> **The user who creates or drafts a record (the "Maker") is strictly prohibited from verifying or approving that record (the "Checker"), regardless of their administrative role or RBAC claim privileges.**
+
+Even if an `Executive`, `Manager`, or `Supervisor` possesses the `update` claim action on a domain, they cannot approve a record if they are identified as the record's creator.
+
+```mermaid
+flowchart LR
+    A["Maker (User A)<br/>Creates Record"] --> B["Record Persisted<br/>with createdBy = User A"]
+    B --> C{"Checker Evaluation<br/>(Approver Login)"}
+    C -->|Checker == User A| D["Approval BLOCKED<br/>Maker-Checker Violation"]
+    C -->|Checker == User B<br/>with 'update' claim| E["Approval GRANTED<br/>Status -> Approved"]
+```
+
+### 4.2 Record Attribution Model
+Every operational domain entity immutably captures the creator identity:
+* `createdBy`: Cryptographic user identifier (Guid / Subject ID) populated from the verified token claim `context.GetUserId()` upon creation.
+* `approvedBy`: User identifier of the independent verifier populated upon successful transition to `Approved`.
+
+### 4.3 Client-Side Enforcement Hooks & Helpers
+In `PostFundManagement.ConsoleUI`, the Maker-Checker rule is evaluated dynamically via [`useRbac()`](file:///c:/Users/Admin/source/repos/PostFundManagement/PostFundManagement.ConsoleUI/src/auth/rbac.ts):
+
+* **`isMaker(createdBy)`**: Compares `createdBy` against current user `user.id`, `sub`, and `user.email`.
+* **`canApproveRecord(claim, createdBy)`**: Evaluates:
+  $$\text{canApproveRecord} = \text{canApprove}(\text{claim}) \land \neg\text{isMaker}(\text{createdBy})$$
+* **`getApprovalRestrictionReason(claim, createdBy)`**: Surfaces explanatory feedback:
+  - `"Requires update/approval permission"` if the claim lacks `update`.
+  - `"Maker-Checker policy: Record creators cannot approve their own records"` if `isMaker` is true.
+
+### 4.4 UI Guard Implementations
+1. **Status Dropdowns**: The `Approved` option in status `<select>` controls is disabled with contextual labels:
+   ```tsx
+   <option value={ApprovalStatus.Approved} disabled={!canApproveRecord('projects_milestones', record.createdBy)}>
+     Approved {isMaker(record.createdBy) ? '(Maker-Checker: Cannot approve own record)' : ''}
+   </option>
+   ```
+2. **Action Buttons**: Fast-track "Approve" buttons (e.g. Budget Approval, Disbursement Authorisation, Evidence Review) are hidden or accompanied by a Maker-Checker indicator badge when viewed by the creator.
+3. **Export Controls**: `<ExportButton>` enforces domain claim checks explicitly (`claim="grant_financials"`), rejecting unauthenticated exports.
+
+---
+
+## 5. Caching Strategy, Mutation Versioning & Performance Optimization
+
+To achieve sub-50ms page transitions while guaranteeing data freshness across mutations in a distributed architecture, PFM employs a multi-tiered caching topology.
+
+```
+┌────────────────────────────────────────────────────────────────────────┐
+│ REACT QUERY CACHE (In-Memory Browser Tier)                             │
+│ staleTime: 2m (dynamic) | 5m (taxonomy) | gcTime: 10m                  │
+└───────────────────────────────────┬────────────────────────────────────┘
+                                    │ Cache Miss / Background Refetch
+┌───────────────────────────────────▼────────────────────────────────────┐
+│ AXIOS CLIENT INTERCEPTOR & MUTATION VERSIONING (_v)                     │
+│ Reads/Browsing: attaches active `_v` epoch token                       │
+│ Mutations (POST/PUT/PATCH/DELETE): auto-bumps epoch -> new `_v` token  │
+└───────────────────────────────────┬────────────────────────────────────┘
+                                    │ HTTP GET /v1/api/*?_v=<epoch>
+┌───────────────────────────────────▼────────────────────────────────────┐
+│ ASP.NET CORE OUTPUTCACHE (Redis / Memory Tier)                         │
+│ Base Policy: 2-minute expiration partitioned by URI + QueryString       │
+│ Hits same `_v` -> 2ms response | New `_v` -> DB query & cache refresh  │
+└────────────────────────────────────────────────────────────────────────┘
+```
+
+### 5.1 The OutputCache Stale Data Challenge
+ASP.NET Core Minimal APIs in `PostFundManagement.Api` attach `.CacheOutput()` to GET endpoints, using a 2-minute base sliding expiration backed by Redis / Memory cache. 
+
+Because OutputCache keys are generated from the HTTP Method, Host, Path, and **Query String**, a naive client refetch after a mutation (e.g. `queryClient.invalidateQueries({ queryKey: ['projects'] })`) calls `GET /v1/api/projects`. OutputCache intercepts this identical URI, returning the pre-mutation response cached earlier. The updated project status or approved milestone does not reflect in the UI until the 2-minute cache expires.
+
+### 5.2 Client-Side Mutation Epoch Versioning
+PFM solves this without modifying backend endpoints via **Client-Side Mutation Versioning**:
+1. **Epoch Tracking (`activeMutationEpoch`)**: `httpClient.ts` tracks an active mutation timestamp initialized from `sessionStorage` or `Date.now()`.
+2. **Automatic Mutation Interceptor**: Every successful mutating HTTP response (`POST`, `PUT`, `PATCH`, `DELETE` with HTTP 2xx) triggers `bumpMutationEpoch()`.
+3. **Query Parameter Injection**: Outgoing `GET` requests to internal APIs automatically append `_v: getMutationEpoch()`.
+4. **Instant Invalidation**: When a mutation succeeds, the epoch is bumped. Subsequent React Query refetches send the new `_v`, producing an immediate **cache miss** in ASP.NET Core OutputCache. The backend queries PostgreSQL, returns fresh data, and caches the new state under the new `_v` key.
+5. **Cache Hit Snappiness**: Navigations between pages while no mutations have occurred reuse the stable `_v`, yielding sub-5ms responses from Redis/Memory OutputCache and 0ms from React Query in-memory cache.
+6. **Explicit Freshness (`_t`)**: When `Cache-Control: no-cache` is specified or during explicit refresh operations, a unique timestamp `_t` is attached to force a guaranteed fresh fetch.
+
+### 5.3 RBAC Startup Pipeline Acceleration
+Following the introduction of fine-grained RBAC and Maker-Checker checks, startup performance was streamlined to eliminate sequential network waterfalls:
+* **Cache-First Role Claims**: `fetchAndCacheSystemRoles` and `fetchAndCacheRoleClaims` check in-memory and `localStorage` caches *before* dispatching network calls.
+* **Parallel User Resolution**: `getUserRolesFromApi` and `getUserClaimsFromApi` are resolved concurrently using `Promise.allSettled`.
+* **Parallel Claim Resolution**: Claims across all assigned roles are retrieved concurrently rather than in serial loops.
+* **Immediate Non-Blocking Session Render**: If valid session tokens and user profiles exist in `localStorage`, `AuthProvider` immediately unblocks UI rendering (`isLoading: false`) and runs tenant lockout checks, account synchronization, and claim revalidation asynchronously in the background.
+* **In-Memory User Sync & Lockout Caching**: `isUserSyncedInBrowser` and `verifyTenantLockout` maintain in-memory references to eliminate synchronous `JSON.parse` operations from the request pipeline.
+
+
@@ -0,0 +1,101 @@
+<Project>
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <LangVersion>latest</LangVersion>
+    <NoWarn>$(NoWarn);1701;1702;MA0048;MA0051;AV0029;AV0030</NoWarn>
+  </PropertyGroup>
+
+  <!-- Assembly signing and licensing for non-test projects -->
+  <PropertyGroup Condition="!$(MSBuildProjectName.EndsWith('Tests'))">
+    <SignAssembly>true</SignAssembly>
+    <AssemblyOriginatorKeyFile>$(MSBuildThisFileDirectory)PostFundManagement.snk</AssemblyOriginatorKeyFile>
+    <PackageLicenseFile>$(MSBuildThisFileDirectory)LICENSE</PackageLicenseFile>
+  </PropertyGroup>
+
+  <!-- Centralized Common Usings across solution -->
+  <ItemGroup>
+    <!-- System & BCL -->
+    <Using Include="System.Collections.ObjectModel" />
+    <Using Include="System.ComponentModel.DataAnnotations" />
+    <Using Include="System.Globalization" />
+    <Using Include="System.Net" />
+    <Using Include="System.Reflection" />
+    <Using Include="System.Security.Cryptography" />
+    <Using Include="System.Security.Cryptography.X509Certificates" />
+    <Using Include="System.Text" />
+    <Using Include="System.Text.Json" />
+    <Using Include="System.Text.Json.Serialization" />
+    <Using Include="System.Text.RegularExpressions" />
+    <Using Include="System.Threading.Channels" />
+    <Using Include="System.Web" />
+
+    <!-- Microsoft Extensions & Web Core -->
+    <Using Include="Microsoft.AspNetCore.Builder" />
+    <Using Include="Microsoft.AspNetCore.Components.Server.ProtectedBrowserStorage" />
+    <Using Include="Microsoft.AspNetCore.DataProtection" />
+    <Using Include="Microsoft.AspNetCore.Http" />
+    <Using Include="Microsoft.AspNetCore.Routing" />
+    <Using Include="Microsoft.Extensions.Configuration" />
+    <Using Include="Microsoft.Extensions.DependencyInjection" />
+    <Using Include="Microsoft.Extensions.DependencyInjection.Extensions" />
+    <Using Include="Microsoft.Extensions.Hosting" />
+    <Using Include="Microsoft.Extensions.Logging" />
+    <Using Include="Microsoft.Extensions.Options" />
+    <Using Include="Microsoft.IdentityModel.Tokens" />
+
+    <!-- Domain Constants -->
+    <Using Static="true" Include="PostFundManagement.Domain.Extensions.Constants" />
+
+    <!-- CQRS, Utilities & Persistence -->
+    <Using Include="FluentResults" />
+    <Using Include="HashidsNet" />
+    <Using Include="Humanizer" />
+    <Using Include="Mediator" />
+    <Using Include="Microsoft.EntityFrameworkCore" />
+    <Using Include="Microsoft.EntityFrameworkCore.Design" />
+    <Using Include="Microsoft.EntityFrameworkCore.Metadata.Builders" />
+    <Using Include="Quartz" />
+    <Using Include="Refit" />
+
+    <!-- API & Documentation -->
+    <Using Include="Asp.Versioning" />
+    <Using Include="Microsoft.AspNetCore.OpenApi" />
+    <Using Include="Microsoft.OpenApi" />
+    <Using Include="Scalar.AspNetCore" />
+
+    <!-- Authentication -->
+    <Using Include="IdentityModel.AspNetCore.OAuth2Introspection" />
+    <Using Include="Microsoft.AspNetCore.Authentication" />
+    <Using Include="Microsoft.AspNetCore.Authentication.Cookies" />
+    <Using Include="Microsoft.AspNetCore.Authentication.JwtBearer" />
+    <Using Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" />
+
+    <!-- Diagnostics & Health -->
+    <Using Include="Microsoft.AspNetCore.Diagnostics.HealthChecks" />
+    <Using Include="Microsoft.Extensions.Diagnostics.HealthChecks" />
+
+    <!-- Messaging & Cloud Storage -->
+    <Using Include="Amazon.Runtime" />
+    <Using Include="Amazon.S3" />
+    <Using Include="Amazon.S3.Model" />
+    <Using Include="MailKit.Net.Smtp" />
+    <Using Include="MimeKit" />
+  </ItemGroup>
+
+  <!-- Domain-specific Usings (Domain and downstream projects excluding Infrastructure where Claim/Activity/TokenRequest collide) -->
+  <ItemGroup Condition="'$(MSBuildProjectName)' == 'PostFundManagement.Domain'">
+    <Using Include="System.Security.Claims" />
+    <Using Include="AccessTokenClient" />
+  </ItemGroup>
+
+  <!-- Non-Domain / Non-Infrastructure Usings (Application, Api, Tests) -->
+  <ItemGroup Condition="'$(MSBuildProjectName)' != 'PostFundManagement.Domain' and '$(MSBuildProjectName)' != 'PostFundManagement.Infrastructure'">
+    <Using Include="System.Diagnostics" />
+    <Using Include="System.Security.Claims" />
+    <Using Include="AccessTokenClient" />
+    <Using Static="true" Include="PostFundManagement.Application.Extensions.General" />
+  </ItemGroup>
+</Project>
+
@@ -0,0 +1,117 @@
+<Project>
+  <PropertyGroup>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <!-- Core & Utilities -->
+    <PackageVersion Include="Castle.Core.AsyncInterceptor" Version="2.1.0" />
+    <PackageVersion Include="Hashids.net" Version="1.7.0" />
+    <PackageVersion Include="Humanizer" Version="3.0.10" />
+    <PackageVersion Include="Scrutor" Version="7.0.0" />
+
+    <!-- Microsoft Extensions & Configuration -->
+    <PackageVersion Include="Microsoft.Extensions.Caching.Hybrid" Version="10.10.0" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Polly" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.10.0" />
+    <PackageVersion Include="Microsoft.Extensions.Validation" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.FeatureManagement.AspNetCore" Version="4.7.0" />
+
+    <!-- Security, Authentication & Identity -->
+    <PackageVersion Include="AccessTokenClient.Extensions" Version="5.1.0" />
+    <PackageVersion Include="Duende.AccessTokenManagement" Version="4.2.0" />
+    <PackageVersion Include="Duende.AccessTokenManagement.OpenIdConnect" Version="4.2.0" />
+    <PackageVersion Include="IdentityModel" Version="6.2.0" />
+    <PackageVersion Include="IdentityModel.AspNetCore" Version="4.3.0" />
+    <PackageVersion Include="IdentityModel.AspNetCore.OAuth2introspection" Version="6.2.0" />
+    <PackageVersion Include="IdentityServer4.AccessTokenValidation" Version="3.0.1" />
+    <PackageVersion Include="KubernetesClient" Version="19.0.2" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.Certificate" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.12" />
+    
+    <!-- Upgraded to latest non-vulnerable version -->
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.13" />
+
+    <!-- Resilience -->
+    <PackageVersion Include="Polly" Version="8.8.0" />
+    <PackageVersion Include="Polly.Extensions" Version="8.8.0" />
+
+    <!-- API, Web & Documentation -->
+    <PackageVersion Include="Asp.Versioning.Abstractions" Version="10.2.1" />
+    <PackageVersion Include="Asp.Versioning.Http" Version="10.2.3" />
+    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="10.2.1" />
+    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.OutputCaching.StackExchangeRedis" Version="10.0.12" />
+    <PackageVersion Include="Refit.HttpClientFactory" Version="15.2.0" />
+    <PackageVersion Include="Scalar.AspNetCore" Version="2.17.4" />
+
+    <!-- Database & Entity Framework Core -->
+    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Abstractions" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Analyzers" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.12" />
+    <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
+
+    <!-- Quartz Scheduler -->
+    <PackageVersion Include="Quartz" Version="4.1.0" />
+    <PackageVersion Include="Quartz.AspNetCore" Version="4.1.0" />
+    <PackageVersion Include="Quartz.Extensions.DependencyInjection" Version="4.1.0" />
+    <PackageVersion Include="Quartz.Plugins" Version="4.1.0" />
+    <PackageVersion Include="Quartz.Plugins.TimeZoneConverter" Version="4.1.0" />
+    <PackageVersion Include="Quartz.Serialization.SystemTextJson" Version="4.1.0" />
+
+    <!-- Health Checks -->
+    <PackageVersion Include="AspNetCore.HealthChecks.NpgSql" Version="9.0.0" />
+    <PackageVersion Include="AspNetCore.HealthChecks.UI" Version="9.0.0" />
+    <PackageVersion Include="AspNetCore.HealthChecks.UI.Client" Version="9.0.0" />
+    <PackageVersion Include="AspNetCore.HealthChecks.UI.Core" Version="9.0.0" />
+    <PackageVersion Include="AspNetCore.HealthChecks.UI.Data" Version="9.0.0" />
+    <PackageVersion Include="AspNetCore.HealthChecks.UI.InMemory.Storage" Version="9.0.0" />
+
+    <!-- Observability & OpenTelemetry -->
+    <PackageVersion Include="OpenTelemetry" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.18.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.18.0" />
+
+    <!-- Email & Messaging -->
+    <PackageVersion Include="MailKit" Version="4.18.0" />
+    <PackageVersion Include="MimeKit" Version="4.18.0" />
+
+    <!-- CQRS & Mediator -->
+    <PackageVersion Include="FluentResults" Version="4.0.0" />
+    <PackageVersion Include="Mediator.Abstractions" Version="3.0.2" />
+    <PackageVersion Include="Mediator.SourceGenerator" Version="3.0.2" />
+
+    <!-- Cloud Storage -->
+    <PackageVersion Include="AWSSDK.Extensions.NetCore.Setup" Version="4.0.101.4" />
+    <PackageVersion Include="AWSSDK.S3" Version="4.0.103.3" />
+
+    <!-- Analyzers -->
+    <PackageVersion Include="Meziantou.Analyzer" Version="3.0.259" />
+
+    <!-- Testing -->
+    <PackageVersion Include="coverlet.collector" Version="6.0.4" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageVersion Include="xunit" Version="2.9.3" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.4" />
+  </ItemGroup>
+</Project>
+
@@ -8,7 +8,11 @@ EXPOSE 8080
 FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
 WORKDIR /src

-# Copy csproj files for layer caching
+# Copy props and csproj files for layer caching
+COPY ["Directory.Build.props", "./"]
+COPY ["Directory.Packages.props", "./"]
+COPY ["PostFundManagement.snk", "./"]
+COPY ["LICENSE", "./"]
 COPY ["PostFundManagement.Api/PostFundManagement.Api.csproj", "PostFundManagement.Api/"]
 COPY ["PostFundManagement.Application/PostFundManagement.Application.csproj", "PostFundManagement.Application/"]
 COPY ["PostFundManagement.Domain/PostFundManagement.Domain.csproj", "PostFundManagement.Domain/"]
@@ -33,4 +37,4 @@ RUN dotnet publish "PostFundManagement.Api.csproj" -c Release -o /app/publish /p
 FROM base AS final
 WORKDIR /app
 COPY --from=publish /app/publish .
-ENTRYPOINT ["dotnet", "PostFundManagement.Api.dll"]
+ENTRYPOINT ["dotnet", "PostFundManagement.Api.dll"]
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Communications;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Communications;
+
+[ApiVersionTarget(1)]
+public sealed class CreateNotificationEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/communications/notifications", async (CreateNotificationRequest request,
+            HttpContext context, ICommunicationsService service, CancellationToken cancellationToken = default) =>
+                await service.CreateNotificationAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Created(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Creates a new in-app or outbound notification record")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateNotificationEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status201Created)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .WithTags(EndpointTags.Communications);
+    }
+}
+
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Communications;

@@ -14,12 +12,12 @@ public sealed class GetApplicantInviteEndpoint : IEndpoint
 {
    public void Map(IEndpointRouteBuilder builder)
    {
-        builder.MapGet("api/communications/invites/applicant/{applicantUserId:Guid}", async (Guid applicantUserId, ICommunicationsService service,
+        builder.MapGet("api/communications/invites/applicants/{applicantUserId:Guid}", async (Guid applicantUserId, ICommunicationsService service,
            HttpContext context, CancellationToken cancellationToken = default) =>
                await service.GetApplicantInviteAsync(applicantUserId, cancellationToken) switch
                {
                    {  IsSuccess: true, Value: var invite } => Results.Ok(invite),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Gets an applicant's invite")
@@ -27,8 +25,8 @@ public sealed class GetApplicantInviteEndpoint : IEndpoint
            .WithName(typeof(GetApplicantInviteEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Invite>(StatusCodes.Status200OK)        
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Communications)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Communications;

@@ -19,7 +17,7 @@ public sealed class GetApplicantInvitesEndpoint : IEndpoint
                await service.GetApplicantInvitesAsync(applicantUserId, cancellationToken) switch
                {
                    {  IsSuccess: true, Value: var invite } => Results.Ok(invite),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
            .WithDescription("Gets an applicant's invite list")
@@ -27,8 +25,8 @@ public sealed class GetApplicantInvitesEndpoint : IEndpoint
            .WithName(typeof(GetApplicantInvitesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Invite[]>(StatusCodes.Status200OK)        
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Communications)
            .CacheOutput();
@@ -0,0 +1,35 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Communications;
+
+[ApiVersionTarget(1)]
+public sealed class GetIApplicantDataEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/communications/applicants/{applicantUserId:Guid}/all", async (Guid applicantUserId, 
+            ICommunicationsService service, CancellationToken cancellationtToken = default ) =>
+                await service.GetApplicantDataAsync(applicantUserId, cancellationtToken) switch
+                {
+                    { IsSuccess: true, Value: var applicantData } => Results.Ok(applicantData),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Gets an applicant's data")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetIApplicantDataEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Invite>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Communications)
+            .CacheOutput();
+    }
+}
@@ -4,9 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using static PostFundManagement.Application.Extensions.General;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Communications;

@@ -0,0 +1,35 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Communications;
+
+[ApiVersionTarget(1)]
+public sealed class GetNotificationsEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/communications/notifications/{organisationId}", async (string organisationId, 
+            ICommunicationsService service, CancellationToken cancellationToken = default) =>
+                await service.GetNotificationsAsync(organisationId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var notifications } => Results.Ok(notifications),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Retrieves the notification system report")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetNotificationsEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Notification[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Notification[]>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Communications)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,49 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Communications;
+
+[ApiVersionTarget(1)]
+public sealed class GetUserNotificationsEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/communications/notifications/user/{userId:guid}", async (Guid userId,
+            ICommunicationsService service, CancellationToken cancellationToken = default) =>
+                await service.GetUserNotificationsAsync(userId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var notifications } => Results.Ok(notifications),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Retrieves all notifications targeted at a specific user")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetUserNotificationsEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Notification[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Communications)
+            .CacheOutput();
+
+        builder.MapGet("api/communications/notifications/inbox", async (HttpContext context,
+            ICommunicationsService service, CancellationToken cancellationToken = default) =>
+                await service.GetUserNotificationsAsync(context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var notifications } => Results.Ok(notifications),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Retrieves all in-app and system notifications targeted at the authenticated caller")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName($"{typeof(GetUserNotificationsEndpoint).ToEndpointName()}Inbox")
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Notification[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Communications)
+            .CacheOutput();
+    }
+}
+
@@ -5,8 +5,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Communications;

@@ -15,11 +13,12 @@ public sealed class SendInviteEndpoint : IEndpoint
 {
    public void Map(IEndpointRouteBuilder builder)
    {
-        builder.MapPost("api/communications/invite", async (InviteRequest request,
+        builder.MapPost("api/communications/invites", async (InviteRequest request,
            HttpContext context, ICommunicationsService service, CancellationToken cancellationToken = default) =>
                await service.SendInviteAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true, Value: var invite } => Results.Ok(invite),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
@@ -29,6 +28,7 @@ public sealed class SendInviteEndpoint : IEndpoint
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Invite>(StatusCodes.Status200OK)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .Produces(StatusCodes.Status401Unauthorized)
            .WithTags(EndpointTags.Communications);
@@ -0,0 +1,37 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Communications;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Communications;
+
+[ApiVersionTarget(1)]
+public sealed class UpdateNotificationEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPut("api/communications/notifications", async (UpdateNotificationRequest request,
+            ICommunicationsService service, CancellationToken cancellationToken = default) =>
+                await service.UpdateNotificationAsync(request, cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.NoContent(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Updates a notification status, delivery timestamp, or error state")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(UpdateNotificationEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status204NoContent)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .WithTags(EndpointTags.Communications);
+    }
+}
+
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Evidence;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -19,7 +17,7 @@ public class CreateIndicatorEndpoint : IEndpoint
                await service.CreateIndicatorAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
@@ -28,8 +26,8 @@ public class CreateIndicatorEndpoint : IEndpoint
            .WithName(typeof(CreateIndicatorEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence);
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Evidence;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -19,7 +17,7 @@ public class CreateMilestoneEndpoint : IEndpoint
                await service.CreateMilestoneAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
@@ -30,6 +28,7 @@ public class CreateMilestoneEndpoint : IEndpoint
            .Produces(StatusCodes.Status200OK)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence);
    }
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -19,7 +17,7 @@ public sealed class GetEvidenceEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var evidence } => Results.Ok(evidence),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific evidence record and assiciated file URLs")
@@ -27,9 +25,9 @@ public sealed class GetEvidenceEndpoint : IEndpoint
            .WithName(typeof(GetEvidenceEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Evidence>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces(StatusCodes.Status403Forbidden)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence)
            .CacheOutput();
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -19,17 +17,17 @@ public sealed class GetEvidenceUrlEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var evidenceUrl } => Results.Ok(evidenceUrl),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Gets a secure download URL of the evidence file, URL expires (default: 15min)")
            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetEvidenceUrlEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
-            .Produces<string>(StatusCodes.Status200OK)
-            .Produces<string>(StatusCodes.Status404NotFound)
-            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<string>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Grants)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -20,7 +18,7 @@ public sealed class GetIndicatorEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var indicator } => Results.Ok(indicator),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific indicator.")
@@ -28,9 +26,9 @@ public sealed class GetIndicatorEndpoint : IEndpoint
            .WithName(typeof(GetIndicatorEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Indicator>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces(StatusCodes.Status403Forbidden)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Evidence;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Evidence;

@@ -19,7 +17,7 @@ public sealed class UpdateEvidenceEndpoint : IEndpoint
                await service.UpdateEvidenceAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
@@ -29,9 +27,9 @@ public sealed class UpdateEvidenceEndpoint : IEndpoint
            .WithName(typeof(UpdateEvidenceEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Evidence);
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Execution;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -19,7 +17,7 @@ public class CreateDisbursementEndpoint : IEndpoint
                await service.CreateDisbursementAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
@@ -28,9 +26,9 @@ public class CreateDisbursementEndpoint : IEndpoint
            .WithName(typeof(CreateDisbursementEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Execution);
    }
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Execution;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -19,7 +17,7 @@ public class CreateRiskEndpoint : IEndpoint
                await service.CreateRiskAsync(request, context.GetUserId(), cancellationToken) switch 
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
@@ -28,9 +26,9 @@ public class CreateRiskEndpoint : IEndpoint
            .WithName(typeof(CreateRiskEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Execution);
    }
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Execution;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Execution;
+
+[ApiVersionTarget(1)]
+public sealed class CreateRuleEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/execution/rules", async (CreateRuleRequest request, HttpContext context,
+            IExecutionService service, CancellationToken cancellationToken = default) =>
+                await service.CreateRuleAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Add rule against a programme")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateRuleEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Execution);
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -20,7 +18,7 @@ public sealed class GetDisbursementEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var disbursement } => Results.Ok(disbursement),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific disbursement")
@@ -28,9 +26,9 @@ public sealed class GetDisbursementEndpoint : IEndpoint
            .WithName(typeof(GetDisbursementEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Disbursement>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Execution)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -20,7 +18,7 @@ public sealed class GetRiskEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var risk  } => Results.Ok(risk),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific risk")
@@ -28,8 +26,8 @@ public sealed class GetRiskEndpoint : IEndpoint
            .WithName(typeof(GetRiskEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Risk>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Execution)
            .CacheOutput();
@@ -3,8 +3,7 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;
+using PostFundManagement.Domain.Models;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -24,7 +23,7 @@ public class GetRisksEndpoint : IEndpoint
            .RequireAuthorization(Constants.MainScope)
            .WithName(typeof(GetRisksEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
+            .Produces<Risk[]>(StatusCodes.Status200OK)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Execution)
@@ -0,0 +1,35 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Execution;
+
+[ApiVersionTarget(1)]
+public sealed class GetRuleEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/execution/rules/{ruleId}", async (string ruleId, IExecutionService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetRuleAsync(ruleId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var rules } => Results.Ok(rules),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Get a specific programme rule")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetRuleEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Rule>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Execution)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,32 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Execution;
+
+[ApiVersionTarget(1)]
+public sealed class GetRulesEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/execution/programmes/rules", async (Pagination pagination, IExecutionService service, 
+            CancellationToken cancellationToken = default) =>
+                await service.GetRulesAsync(pagination, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var rules } => Results.Ok(rules),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Get a list of all programme rules")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetRulesEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Rule[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Execution)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Execution;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Execution;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Execution;

@@ -0,0 +1,33 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Execution;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Execution;
+
+[ApiVersionTarget(1)]
+public sealed class UpdateRuleEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPut("api/execution/rules", async (UpdateRuleRequest request, HttpContext context,
+            IExecutionService service, CancellationToken cancellationToken = default) =>
+                await service.UpdateRuleAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Update the details of a specific programme rule (supplied version auto-increment)")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(UpdateRuleEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Execution);
+    }
+}
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Governance;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class CreateInstrumentEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/governance/instruments", async (CreateInstrumentRequest request, HttpContext context,
+            IGovernanceService service, CancellationToken cancellationToken = default) =>
+                await service.CreateInstrumentAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true} => Results.Ok(),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Creates a new programme funding instrument")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateInstrumentEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -19,6 +17,7 @@ public sealed class CreateOrganisationEndpoint : IEndpoint
                await service.CreateOrganisationAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Governance;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class CreateTenantEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/governance/tenants", async (CreateTenantRequest request, IGovernanceService service, HttpContext context,
+            CancellationToken cancellationToken = default) =>
+                await service.CreateTenantAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Create a new tenant")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateTenantEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)                        
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance);
+    }
+}
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -0,0 +1,33 @@
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Shared;
+using PostFundManagement.Domain;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class GetAuditLogsEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/governance/auditlog", async (Pagination pagination, AuditService service, 
+            CancellationToken cancellationToken = default) =>
+                await service.GetAuditLogsAsync(pagination, cancellationToken) switch
+                {
+                    {  IsSuccess: true, Value: var logs } => Results.Ok(logs),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Retrieves audit logs based on pagination parameters")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetAuditLogsEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<AuditLog[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -18,7 +16,7 @@ public class GetInstrumentsEndpoint : IEndpoint
            CancellationToken cancellationToken = default) =>
                await service.GetInstrumentsAsync(programmeId, cancellationToken) switch
                {
-                    { IsSuccess: true, Value: var instrumenrs } => Results.Ok(instrumenrs),
+                    { IsSuccess: true, Value: var instruments } => Results.Ok(instruments),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
                    var r => Results.InternalServerError(r.Errors.ToProblems()),
                })
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -20,7 +18,7 @@ public class GetOrganisationEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var organisation } => Results.Ok(organisation),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get organization profile by ID")
@@ -28,9 +26,9 @@ public class GetOrganisationEndpoint : IEndpoint
            .WithName(typeof(GetOrganisationEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Organisation>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces(StatusCodes.Status403Forbidden)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Governance)
            .CacheOutput();
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public class GetOrganisationPortfoliosEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/organisations/{organisationId}/portfolio", async (string organisationId,
+            IGovernanceService service, CancellationToken cancellationToken = default) =>
+                await service.GetOrganisationPorfoliosAsync(organisationId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var portfolios } => Results.Ok(portfolios),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Get all portfolios belonging to a specific organisation")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetOrganisationPortfoliosEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Portfolio[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class GetPorfolioValueEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/portfolios/{portfolioId}/value", async (string portfolioId, IGovernanceService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetPorfolioValueAsync(portfolioId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var amount } => Results.Ok(amount),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Calculates and returns a portfolio's total project's budget value")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetPorfolioValueEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<decimal>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -19,7 +17,7 @@ public sealed class GetPortfolioEndpoint : IEndpoint
                await service.GetPortfolioAsync(portfolioIdHash: portfolioId, cancellationToken) switch
                {
                    {  IsSuccess: true, Value: var portfolio } => Results.Ok(portfolio),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get a specific portfolios")
@@ -27,9 +25,9 @@ public sealed class GetPortfolioEndpoint : IEndpoint
            .WithName(typeof(GetPortfolioEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Portfolio[]>(StatusCodes.Status200OK)
-            .Produces<Portfolio[]>(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Governance)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -19,7 +17,7 @@ public sealed class GetPortfolioProgrammesEndpoint : IEndpoint
                await service.GetPortfolioProgrammesAsync(portfolioId, cancellationToken) switch
                {
                    { IsSuccess: true, Value: var portfolios } => Results.Ok(portfolios),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
@@ -28,9 +26,9 @@ public sealed class GetPortfolioProgrammesEndpoint : IEndpoint
            .WithName(typeof(GetPortfolioProgrammesEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Programme[]>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Governance)
            .CacheOutput();
@@ -1,25 +1,22 @@
-using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
-using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

 [ApiVersionTarget(1)]
-public class GetPortfoliosEndpoint : IEndpoint
+public sealed class GetPortfoliosEndpoint : IEndpoint
 {
    public void Map(IEndpointRouteBuilder builder)
    {
-        builder.MapGet("api/governance/organisations/{organisationId}/portfolio", async (string organisationId,
-            IGovernanceService service, CancellationToken cancellationToken = default) =>
-                await service.GetPorfoliosAsync(organisationId, cancellationToken) switch
+        builder.MapPost("api/governance/organisations/portfolios", async (Pagination pagination, IGovernanceService service, 
+            CancellationToken cancellationToken = default) =>
+                await service.GetPorfoliosAsync(pagination, cancellationToken) switch
                {
                    { IsSuccess: true, Value: var portfolios } => Results.Ok(portfolios),
-                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get all portfolios")
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class GetProgrammeValueEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/programmes/{programmeId}/value", async (string programmeId, IGovernanceService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetProgrammeValueAsync(programmeId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var amount } => Results.Ok(amount),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Calculates and returns a programme's total project budget value")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetProgrammeValueEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<decimal>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -0,0 +1,35 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class GetTenantEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/tenants/{tenantId}", async (string tenantId, IGovernanceService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetTenantAsync(tenantId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var tenant } => Results.Ok(tenant),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets a single tenant")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetTenantsEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Tenant>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance);
+    }
+}
@@ -0,0 +1,33 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class GetTenantOrganisationsEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/tenants/{tenantIdHash}/organisations", async (IGovernanceService service, string tenantIdHash,
+            CancellationToken cancellationToken = default) =>
+                await service.GetTenantOrganisationsAsync(tenantIdHash, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var tenantOrganisations } => Results.Ok(tenantOrganisations),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets organisations created and managed by one tenant")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetTenantOrganisationsEndpoint).ToEndpointName("Retrieval"))
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<TenantOrganisation[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance);
+    }
+}
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class GetTenantUsersEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/tenants/{tenantIdHash}/users", async (IGovernanceService service, string tenantIdHash,
+            CancellationToken cancellationToken = default) =>
+                await service.GetTenantUsersAsync(tenantIdHash, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var tenantUsers } => Results.Ok(tenantUsers),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets users created and managed by one tenant")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetTenantUsersEndpoint).ToEndpointName("Retrieval"))
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<TenantUser[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance);
+    }
+}
+
@@ -0,0 +1,30 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Entities;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class GetTenantsEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/governance/tenants", async (IGovernanceService service, 
+            CancellationToken cancellationToken = default) =>
+                await service.GetTenantsAsync(cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var tenants } => Results.Ok(tenants),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets system tenants")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetTenantsEndpoint).ToEndpointName("Retrieval"))
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Tenant[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance);
+    }
+}
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Governance;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Governance;
+
+[ApiVersionTarget(1)]
+public sealed class UpdateInstrumentEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPut("api/governance/instruments", async (UpdateInstrumentRequest request, HttpContext context,
+            IGovernanceService service, CancellationToken cancellationToken = default) =>
+                await service.UpdateInstrumentAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Updates a programme funding instrument")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(UpdateInstrumentEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -15,11 +13,13 @@ public sealed class UpdateOrganisationEndpoint : IEndpoint
    public void Map(IEndpointRouteBuilder builder)
    {
        builder.MapPut("api/governance/organisations", async (UpdateOrganisationRequest request,
-            IGovernanceService service, CancellationToken cancellationToken = default) => 
-                await service.UpdateOrganisationAsync(request, cancellationToken) switch
+            IGovernanceService service, HttpContext context, CancellationToken cancellationToken = default) =>
+                await service.UpdateOrganisationAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Update an existing organization profile")
@@ -27,10 +27,10 @@ public sealed class UpdateOrganisationEndpoint : IEndpoint
            .WithName(typeof(UpdateOrganisationEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .Produces(StatusCodes.Status401Unauthorized)
            .WithTags(EndpointTags.Governance);
    }
 }
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Governance;

@@ -1,36 +1,34 @@
 using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Governance;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

-namespace PostFundManagement.Api.Endpoints.Tools;
+namespace PostFundManagement.Api.Endpoints.Governance;

 [ApiVersionTarget(1)]
-public sealed class EncodeIdEndpoint : IEndpoint
+public sealed class UpdateTenantEndpoint : IEndpoint
 {
    public void Map(IEndpointRouteBuilder builder)
    {
-        builder.MapGet("api/tools/hashid/{id64:long}", async (long id64, IToolService service, 
-            CancellationToken cancellationToken) =>
-                await service.EncodeLong(id64, cancellationToken) switch
+        builder.MapPut("api/governance/tenants", async (UpdateTenantRequest request, HttpContext context, 
+            IGovernanceService service, CancellationToken cancellationToken = default) =>
+                await service.UpdateTenantAsync(request, context.GetUserId(), cancellationToken) switch
                {
-                    { IsSuccess: true, Value: var hash } => Results.Ok(hash),
+                    { IsSuccess: true } => Results.Ok(),
                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
-            .WithDescription("Hashes an int64 identifier")
+            .WithDescription("Updates a specific tenant")
            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(EncodeIdEndpoint).ToEndpointName())
+            .WithName(typeof(UpdateTenantEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
-            .Produces<string>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status200OK)
            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces(StatusCodes.Status403Forbidden)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Tools)
-            .CacheOutput();
+            .WithTags(EndpointTags.Governance);
    }
 }
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -19,7 +17,7 @@ public class CreateAwardEndpoint : IEndpoint
                await service.CreateAwardAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
@@ -30,7 +28,7 @@ public class CreateAwardEndpoint : IEndpoint
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Grants);
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -20,8 +18,8 @@ public class CreateBudgetEndpoint : IEndpoint
                {
                    {  IsSuccess: true } => Results.Ok(),
                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
-                    var r when r.HasError<CreateError>() => Results.BadRequest(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Create a new budget line (M05)")
@@ -29,8 +27,8 @@ public class CreateBudgetEndpoint : IEndpoint
            .WithName(typeof(CreateBudgetEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .Produces(StatusCodes.Status401Unauthorized)
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -19,7 +17,7 @@ public class CreateContractEndpoint : IEndpoint
                await service.CreateContractAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
@@ -29,6 +27,7 @@ public class CreateContractEndpoint : IEndpoint
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .Produces(StatusCodes.Status401Unauthorized)
            .WithTags(EndpointTags.Grants);
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -20,7 +18,7 @@ public class GetAwardEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var award } => Results.Ok(award),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get award by ID")
@@ -30,7 +28,7 @@ public class GetAwardEndpoint : IEndpoint
            .Produces<Award>(StatusCodes.Status200OK)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Grants)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -20,7 +18,7 @@ public class GetBudgetEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var budget } => Results.Ok(budget),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get budget by ID")
@@ -28,7 +26,7 @@ public class GetBudgetEndpoint : IEndpoint
            .WithName(typeof(GetBudgetEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Budget>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -20,7 +18,7 @@ public class GetContractEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var contract } => Results.Ok(contract),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Get contract by ID")
@@ -28,7 +26,7 @@ public class GetContractEndpoint : IEndpoint
            .WithName(typeof(GetContractEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Contract>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -19,7 +17,7 @@ public sealed class GetContractUrlEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var contractUrl} => Results.Ok(contractUrl),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Gets a secure download URL, has expiry period (default 15min)")
@@ -29,7 +27,7 @@ public sealed class GetContractUrlEndpoint : IEndpoint
            .Produces<string>(StatusCodes.Status200OK)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Grants)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Grants;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Grants;
+
+[ApiVersionTarget(1)]
+public sealed class UpdateAwardEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPut("api/grants/awards", async (UpdateAwardRequest request, HttpContext context,
+            IGrantsService service, CancellationToken cancellationToken = default) =>
+                await service.UpdateAwardAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Updates a registered funding award")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(UpdateAwardEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Grants);
+    }
+}
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Grants;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Grants;
+
+[ApiVersionTarget(1)]
+public sealed class UpdateBudgetEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPut("api/grants/budgets", async (UpdateBudgetRequest request, HttpContext context,
+            IGrantsService service, CancellationToken cancellationToken = default) =>
+                await service.UpdateBudgetAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Updates a specific budget")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(UpdateBudgetEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)            
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Governance)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Grants;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -19,7 +17,7 @@ public sealed class UpdateContractEndpoint : IEndpoint
                await service.UpdateContractAsync(request, cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
@@ -30,7 +28,7 @@ public sealed class UpdateContractEndpoint : IEndpoint
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Grants)
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Grants;

@@ -40,7 +38,6 @@ public sealed class UploadContractEndpoint : IEndpoint
        .Produces(StatusCodes.Status200OK)
        .Produces(StatusCodes.Status403Forbidden)
        .Produces(StatusCodes.Status401Unauthorized)
-        .Produces(StatusCodes.Status404NotFound)
        .Produces<Problems>(StatusCodes.Status500InternalServerError)
        .WithTags(EndpointTags.Grants)
        .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Projects;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -19,7 +17,7 @@ public class CreateActivityEndpoint : IEndpoint
                await service.CreateActivityAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } result => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
@@ -28,6 +26,7 @@ public class CreateActivityEndpoint : IEndpoint
            .WithName(typeof(CreateActivityEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .Produces(StatusCodes.Status401Unauthorized)
@@ -0,0 +1,33 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Projects;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class CreateBeneficiaryEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/projects/beneficiaries", async (CreateBeneficiaryRequest request, HttpContext context,
+            IProjectService service, CancellationToken cancellationToken = default) =>
+                await service.CreateBeneficiaryAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Add a new project beneficiary")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateBeneficiaryEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .WithTags(EndpointTags.Projects);
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Projects;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class CreateChangeRequestEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/projects/changerequests", async (CreateChangeRequest request, IProjectService service,
+            HttpContext context, CancellationToken cancellationToken = default) =>
+                await service.CreateChangeRequestAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems()),
+                })
+            .WithDescription("Create a new change request against an existing project")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateChangeRequestEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects);
+    }
+}
@@ -0,0 +1,34 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Projects;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class CreateComplianceItemEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/projects/complianceitems", async (CreateComplianceItemRequest request, HttpContext context,
+            IProjectService service, CancellationToken cancellationToken = default) => 
+                await service.CreateComplianceItemAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    {  IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Add a new beneficiary compliance item")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateComplianceItemEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .WithTags(EndpointTags.Projects);
+    }
+}
@@ -0,0 +1,33 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Projects;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class CreateIssueEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/projects/issues", async (CreateIssueRequest request, HttpContext context,
+            IProjectService service, CancellationToken cancellationToken = default) =>
+                await service.CreateIssueAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Add a new project issue")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateIssueEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .WithTags(EndpointTags.Projects);
+    }
+}
@@ -0,0 +1,46 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Projects;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class CreateOutcomeEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/projects/beneficiaries/outcomes", HandleCreateAsync)
+            .WithDescription("Add a new beneficiary outcome")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateOutcomeEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .WithTags(EndpointTags.Projects);
+
+        builder.MapPost("api/projects/beneficiaris/outcomes", HandleCreateAsync)
+            .WithDescription("Add a new beneficiary outcome (legacy route)")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateOutcomeEndpoint).ToEndpointName("TypoAlias"))
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .WithTags(EndpointTags.Projects);
+    }
+
+    private static async Task<IResult> HandleCreateAsync(CreateOutcomeRequest request, HttpContext context,
+        IProjectService service, CancellationToken cancellationToken = default) =>
+        await service.CreateOutcomeAsync(request, context.GetUserId(), cancellationToken) switch
+        {
+            { IsSuccess: true } => Results.Ok(),
+            var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+            var r => Results.InternalServerError(r.Errors.ToProblems())
+        };
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Projects;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -19,7 +17,7 @@ public sealed class CreateProgrammeEndpoint : IEndpoint
                await service.CreateProgrammeAsync(request, userId: context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
@@ -29,9 +27,9 @@ public sealed class CreateProgrammeEndpoint : IEndpoint
            .WithName(typeof(CreateProgrammeEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Projects);
    }
@@ -4,8 +4,6 @@ using PostFundManagement.Application.Services.Projects;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -19,7 +17,7 @@ public class CreateProjectEndpoint : IEndpoint
                await service.CreateProjectAsync(request, context.GetUserId(), cancellationToken) switch
                {
                    { IsSuccess: true } result => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r when r.HasError<ValidationError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
@@ -29,9 +27,9 @@ public class CreateProjectEndpoint : IEndpoint
            .WithName(typeof(CreateProjectEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status400BadRequest)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status401Unauthorized)
            .WithTags(EndpointTags.Projects);
    }
@@ -0,0 +1,33 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Application.Services.Projects;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class CreateSiteVisitEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapPost("api/projects/sitevisits", async (CreateSiteVisitRequest request, HttpContext context,
+            IProjectService service, CancellationToken cancellationToken = default) =>
+                await service.CreateSiteVisitAsync(request, context.GetUserId(), cancellationToken) switch
+                {
+                    { IsSuccess: true } => Results.Ok(),
+                    var r when r.HasError<CreateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Add a new project site visit")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(CreateSiteVisitEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces(StatusCodes.Status200OK)
+            .Produces<Problems>(StatusCodes.Status400BadRequest)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .WithTags(EndpointTags.Projects);
+    }
+}
@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -3,8 +3,6 @@ using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -19,7 +17,7 @@ public class GetActivityEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var activity } => Results.Ok(activity),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Gets a specific activity by it's id")
@@ -27,9 +25,9 @@ public class GetActivityEndpoint : IEndpoint
            .WithName(typeof(GetActivityEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Domain.Models.Activity>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Projects)
            .CacheOutput();
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetBeneficiariesEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/{projectId}/beneficiaries", async (string projectId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetBeneficiariesAsync(projectId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var beneficiaries } => Results.Ok(beneficiaries),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets project beneficiaries")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetBeneficiariesEndpoint).ToEndpointName("Retrieval"))
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Beneficiary[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetBeneficiaryEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/beneficiaries/{beneficiaryId}", async (string beneficiaryId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetBeneficiaryAsync(beneficiaryId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var beneficiary } => Results.Ok(beneficiary),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets project beneficiaries")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetBeneficiariesEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Beneficiary>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetChangeRequestEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/changerequests/{changeRequestId}", async (string changeRequestId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetChangeRequestAsync(changeRequestId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var changeRequest } => Results.Ok(changeRequest),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets a specific project change request")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetChangeRequestEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<ChangeRequest>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetChangeRequestsEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/{projectId}/changerequests", async (string projectId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetChangeRequestsAsync(projectId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var changeRequests } => Results.Ok(changeRequests),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets project change requests")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetChangeRequestsEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<ChangeRequest[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetComplianceItemEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/complianceitems/{complianceItemId}", async (string complianceItemId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetComplianceItemAsync(complianceItemId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var complianceItem } => Results.Ok(complianceItem),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets a specific project compliance item")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetComplianceItemEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<ComplianceItem>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetComplianceItemsEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/{projectId}/complianceitems", async (string projectId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetComplianceItemsAsync(projectId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var complianceItems } => Results.Ok(complianceItems),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets project compliance items")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetComplianceItemsEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<ComplianceItem[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetIssueEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/issues/{issueId}", async (string issueId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetIssueAsync(issueId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var issue } => Results.Ok(issue),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets a specific project issue")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetIssueEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Issue>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -0,0 +1,36 @@
+using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Extensions;
+using PostFundManagement.Domain.Abstractions;
+using PostFundManagement.Domain.Errors;
+using PostFundManagement.Domain.Extensions;
+using PostFundManagement.Domain.Models;
+
+namespace PostFundManagement.Api.Endpoints.Projects;
+
+[ApiVersionTarget(1)]
+public sealed class GetIssuesEndpoint : IEndpoint
+{
+    public void Map(IEndpointRouteBuilder builder)
+    {
+        builder.MapGet("api/projects/{projectId}/issues", async (string projectId, IProjectService service,
+            CancellationToken cancellationToken = default) =>
+                await service.GetIssuesAsync(projectId, cancellationToken) switch
+                {
+                    { IsSuccess: true, Value: var issues } => Results.Ok(issues),
+                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                    var r => Results.InternalServerError(r.Errors.ToProblems())
+                })
+            .WithDescription("Gets project issues")
+            .RequireAuthorization(Constants.MainScope)
+            .WithName(typeof(GetIssuesEndpoint).ToEndpointName())
+            .MapToApiVersion(new ApiVersion(1))
+            .Produces<Issue[]>(StatusCodes.Status200OK)
+            .Produces(StatusCodes.Status403Forbidden)
+            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
+            .Produces<Problems>(StatusCodes.Status500InternalServerError)
+            .WithTags(EndpointTags.Projects)
+            .CacheOutput();
+    }
+}
@@ -4,8 +4,6 @@ using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

@@ -20,7 +18,7 @@ public class GetMilestoneEndpoint : IEndpoint
                {
                    { IsSuccess: true, Value: var milestone } => Results.Ok(milestone),
                    var r when r.HasError<IdDecodeError>() => Results.Forbid(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(),
+                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
                    var r => Results.InternalServerError(r.Errors.ToProblems())
                })
            .WithDescription("Gets a specific milestone")
@@ -28,9 +26,9 @@ public class GetMilestoneEndpoint : IEndpoint
            .WithName(typeof(GetMilestoneEndpoint).ToEndpointName())
            .MapToApiVersion(new ApiVersion(1))
            .Produces<Milestone>(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status404NotFound)
            .Produces(StatusCodes.Status403Forbidden)
            .Produces(StatusCodes.Status401Unauthorized)
+            .Produces<Problems>(StatusCodes.Status404NotFound)
            .Produces<Problems>(StatusCodes.Status500InternalServerError)
            .WithTags(EndpointTags.Projects)
            .CacheOutput();
@@ -4,8 +4,6 @@ using PostFundManagement.Domain;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Extensions;
 using PostFundManagement.Domain.Models;
-using PostFundManagement.Domain.Security;
-using Problems = Microsoft.AspNetCore.Mvc.ProblemDetails;

 namespace PostFundManagement.Api.Endpoints.Projects;

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
hermes	bf384d7e6a	Reverted changes	2026-10-24 12:12:27 +02:00
hermes	957d2210a9	Refactored sync process	2026-10-24 12:11:48 +02:00
hermes	16fb6b9434	Simplified lockout modals	2026-10-24 11:48:19 +02:00
hermes	7220700bac	Removed setUserLockout from PartnerUI	2026-10-24 11:39:47 +02:00
hermes	3316fc0275	Fixed sync handshake	2026-10-23 10:19:30 +02:00
hermes	8f58e15f0f	Implemented partnerui	2026-10-23 00:58:47 +02:00
hermes	9ed210613e	Applied mailbox constraints	2026-10-22 23:57:38 +02:00
hermes	5050c901bc	Fixed notification composition	2026-10-22 23:36:03 +02:00
hermes	46c6ddcc80	Implemented notification strategy	2026-10-22 22:59:33 +02:00
hermes	7071c404f0	Implemented markdown based notification message body formatting	2026-10-22 18:19:08 +02:00
hermes	cb89817d88	Implemented mailbox in ConsoleUI	2026-10-22 18:01:22 +02:00
hermes	6ff016e7ec	Fixed beneficiary page type error	2026-10-22 17:14:35 +02:00
hermes	d45a89ab67	Fixed beneficiary outcomes misconfiguration	2026-10-22 17:08:01 +02:00
hermes	3fda1ac5db	Applied RBAC to compliance dashboard	2026-10-22 16:06:05 +02:00
hermes	efc63ca398	Fixed error with compliance page	2026-10-22 15:58:22 +02:00
hermes	299d6ff4dc	Improved compliance monitoring	2026-10-22 15:42:36 +02:00
hermes	9835121fd9	Enforced relationships between activities and indicators, fixed actuals recording	2026-10-22 13:47:54 +02:00
hermes	4dd0899209	Implemented audit logging	2026-10-22 12:31:37 +02:00
hermes	92891438f6	Enforced approval rights	2026-10-22 11:25:55 +02:00
hermes	0261a6093e	Refactored project view into modal Elevated toast message priority	2026-10-22 09:41:41 +02:00
hermes	ccc49df720	Refactored projects page, fixed security user modal	2026-10-22 07:39:33 +02:00
hermes	c24e809b88	Applied UI rendering fixes	2026-10-22 06:23:22 +02:00
hermes	87f597c091	docs: formalize C# formatting, brace discipline, FluentResults vs ternary, grouping, and clean namespace rules in GEMINI.md	2026-10-22 05:01:10 +02:00
hermes	5a6c951641	docs: codify C# functional style, low branching, try-catch avoidance, and Clean/Vertical Slice/SOLID/DRY balance in GEMINI.md	2026-10-22 04:55:44 +02:00
hermes	acf8bc224b	Fixed docker compose	2026-10-21 11:06:56 +02:00
hermes	558ca0dbb4	Resolved volnerability	2026-10-21 11:00:48 +02:00
hermes	270929948d	Restructured .net solutions Resolved volnerability	2026-10-21 10:41:23 +02:00
hermes	95a86e1a87	Fixed new user username formating	2026-10-21 10:16:54 +02:00
hermes	5d7e2f74ce	RBAC Improvements Caching improvements Maker-Checker Implementation	2026-10-21 07:27:47 +02:00
hermes	dee9098379	Fixed tenant management	2026-10-20 17:56:04 +02:00
hermes	d7a168c9fa	Create Organisation Fix	2026-10-20 12:47:06 +02:00
hermes	28a821ae91	Added GEMINI.md file	2026-10-19 10:54:11 +02:00
hermes	1142cfd94e	Implemented rbac	2026-10-11 11:16:08 +02:00
hermes	45a6c0aca0	Fixed skoruba api value assignment in docker compose	2026-10-11 08:29:30 +02:00
hermes	1b586da2ab	Fixed skoruba api address configs	2026-10-11 08:17:21 +02:00
hermes	4735551e06	Removed nontest user	2026-10-11 08:02:33 +02:00
hermes	a28caa5c69	Corrected admin security docker compose api configs	2026-10-11 08:01:33 +02:00
hermes	c3cc21f334	Refactored docker compose	2026-10-11 07:49:38 +02:00
hermes	9a0371fb08	Added skorubauserservice tests	2026-10-11 07:43:51 +02:00
hermes	381d5b7e94	Stable user lockout, role and claim calls	2026-10-10 18:14:31 +02:00
hermes	d3566c5e43	Light refactor	2026-10-10 15:44:27 +02:00
hermes	0352d154a4	Added debug only fact	2026-10-10 15:35:32 +02:00
hermes	8eca793f5f	Added skoruba user service integration test	2026-10-10 15:31:36 +02:00
hermes	343f405982	Added consolidated applicant data retrieval endpoint	2026-10-10 11:11:23 +02:00
hermes	2ee7a49122	Added user management endpoints	2026-10-10 10:12:13 +02:00
hermes	1ebd83a2f4	Removed repetetive static usings and aliases	2026-10-05 08:57:39 +02:00
hermes	da2c0f9a34	Now using global static usings on endpoints to reduce boilerplate	2026-10-05 08:33:00 +02:00
hermes	34ddfc1d73	Redesigned nav bar	2026-10-04 18:27:08 +02:00
hermes	236f6f0f9d	Refactored org modal logic	2026-10-04 18:21:48 +02:00
hermes	c9deba0427	Fixed linked user resolution	2026-10-04 18:04:36 +02:00
hermes	84a171d4a4	Added stubs for user management endpoints	2026-10-04 15:17:22 +02:00
hermes	06539236a1	Added skoruba api integration	2026-10-04 14:31:06 +02:00
hermes	b3957f4af4	Refactored org create and update models	2026-10-04 11:13:09 +02:00
hermes	d8a95f3f92	Refactored tenant organisatio listing in tenant page	2026-10-04 11:08:52 +02:00
hermes	13712be13b	Corrected boolean logic on bypass filter logic	2026-10-04 10:57:42 +02:00
hermes	681ed99fea	Fine tuned organisation onboarding and tenant management	2026-10-04 10:34:59 +02:00
hermes	5fb67df9ac	Refactored organisation entities and endpoints	2026-10-04 10:11:28 +02:00
hermes	8fed46961a	Added tenant management Applied basic access control	2026-10-04 09:13:55 +02:00
hermes	8100518549	Hardened API and catered for Partner role query filter bypass	2026-10-04 08:18:43 +02:00
hermes	8d069c2da0	Redesigned dash	2026-09-29 12:24:04 +02:00
hermes	8643b2625b	Refactored dashboard	2026-09-29 11:41:14 +02:00
hermes	c805a31824	Fixed missing dependency	2026-09-28 16:46:50 +02:00
hermes	67fa99c64a	Added dockerfile to partner ui	2026-09-28 16:33:18 +02:00
hermes	9f6c1e505b	Added partner client env var	2026-09-28 16:26:05 +02:00
hermes	c4f57b92ef	Added pfm-partner to compose file	2026-09-28 16:15:43 +02:00
hermes	7d510d9fbc	Added partner app	2026-09-28 16:13:42 +02:00
hermes	242a4c6fbb	Fixed timeline height Moved export and fixed data output Added project budget amount widget to project listing	2026-09-28 11:55:52 +02:00
hermes	891801c73d	Light projects page refactor	2026-09-28 11:45:05 +02:00
hermes	8b68f7b99c	Refactored projects and milestones page	2026-09-28 11:34:11 +02:00
hermes	93b3416d2c	Removed duplicate filter in settings page Improved Rule value handling	2026-09-28 11:10:17 +02:00
hermes	ef13117042	Added Role column to user directory	2026-09-28 10:58:02 +02:00
hermes	8eae097e8b	Corrected user role mapping	2026-09-28 10:39:32 +02:00
hermes	ea71e55e2d	Refactored UI Added Role filed to user table and endpoint implementation	2026-09-28 10:25:00 +02:00
hermes	7037ea72ca	Refactored get compliance item endpoint	2026-09-27 15:05:42 +02:00
hermes	104f01e515	fixed create site visit error	2026-09-27 14:41:08 +02:00
hermes	0d626fd84a	Fixed error handling	2026-09-27 14:35:52 +02:00
hermes	9ba48de55b	ui tweaks	2026-09-27 14:27:01 +02:00
hermes	6107de3e53	fixed new change request logic	2026-09-27 14:16:08 +02:00
hermes	df167caf55	Fixed mismatched endpoint calling	2026-09-27 14:07:44 +02:00
hermes	8afceda1cd	Fixed change management rendering error	2026-09-27 13:43:14 +02:00
hermes	c1c5641d1e	Updated api usage, corrected table designs	2026-09-27 13:31:27 +02:00
hermes	2efd2859c7	Refactored docker compose	2026-09-27 13:07:55 +02:00
hermes	dd6996bdb1	Refactored endpoints	2026-09-27 13:06:50 +02:00
hermes	1df0b97daf	Issue creation, reolution is optional	2026-09-27 12:55:29 +02:00
hermes	e6fdcf3d0d	Fixed UI inconsistencies	2026-09-27 12:04:22 +02:00
hermes	36e5d3d7c8	Added, beneficiaries, site visits and change management	2026-09-27 11:40:28 +02:00
hermes	fb27cc8c92	Removed settings page mock data and replaced with api calls	2026-09-27 10:58:08 +02:00
hermes	6ab01830f3	Added audit log endpoint	2026-09-27 10:11:56 +02:00
hermes	6e6419ab51	Revised all UIs	2026-09-26 16:36:45 +02:00
hermes	ed6e57ffa9	Added budget update Added portfolio and programme value calculator endpoints	2026-09-26 15:14:29 +02:00
hermes	6be74e9a24	Added postcss	2026-09-26 13:54:39 +02:00
hermes	2949d6218b	Implemented data export	2026-09-26 13:45:42 +02:00
hermes	15a8d8f449	Fixed portfolio retrieval	2026-09-26 12:03:47 +02:00
hermes	db07ad1a82	Added missing instrument endpoints	2026-09-26 11:20:57 +02:00
hermes	11967e3252	Fixed update organisation	2026-09-26 10:39:22 +02:00
hermes	f3a8f78144	Fixed API calls on governance page Enforced multitenancy	2026-09-26 10:28:43 +02:00
hermes	b2688867f3	Surfaced programme rules	2026-09-26 07:55:49 +02:00
hermes	0f903a58b5	Recolved endpoint name ambiguity	2026-09-25 19:06:03 +02:00
hermes	86e2bad4fe	Implemented remaining business functionality	2026-09-25 19:00:50 +02:00
hermes	1efbf9d99f	Added TenantId to mapper methods on all affected models	2026-09-25 08:20:36 +02:00
hermes	24697776d0	Refactored roganisation routines to use TenantOrganisation	2026-09-25 04:01:31 +02:00
hermes	4b806a3202	UserService refactored to integrate into TenantUser	2026-09-25 03:55:20 +02:00
hermes	26df423180	Refactored cache services	2026-09-25 03:04:37 +02:00
hermes	f39eb9d8fe	Removed tools feature	2026-09-24 16:00:06 +02:00
hermes	593219db8c	Stable run, Added remaining service implementations (stubs)	2026-09-24 15:57:33 +02:00
hermes	020bdee36f	Stable run using Multi tenancy across entire estate Audit logging and error logging active	2026-09-24 12:00:47 +02:00
hermes	8e0c099867	Stable multitenancy	2026-09-24 10:25:07 +02:00
hermes	ef134a5b3c	Implemented audit logging and automated logging	2026-09-23 05:33:16 +02:00
hermes	717b891554	Added linkage to primary tenant entities	2026-09-22 07:08:57 +02:00
hermes	91d325ce4e	Make retrieval of contract file auditable	2026-09-22 06:28:54 +02:00
hermes	3cc8514136	Added automatic audit feature	2026-09-22 06:09:51 +02:00
hermes	11311421ad	Removed ValueTask generally where not needed Removed relationships from audit log	2026-09-22 05:44:25 +02:00
hermes	f4024d563a	Implemented centralised audit logging	2026-09-21 16:32:56 +02:00
hermes	78b03b6996	Colocated entity type configurations with entities Added tenant entities and models Modified db context	2026-09-21 09:34:49 +02:00