---
search:
  tags:
    - Business controls
    - POST
seo:
  description: >-
    Owner administration or the explicitly assigned business permission is…
    Reference for the POST /api/v1/security/reviews endpoint in the PharmaFlow
    API.
sidebar:
  label: POST /reviews
  badge: POST
title: POST /reviews
type: openapi-operation
---
Owner administration or the explicitly assigned business permission is required. Actions are scoped to the signed-in branch. A request cannot be approved by its creator. Locked sessions return 423.

`POST /api/v1/security/reviews`

**Request body** (`application/json`, required)

- `client_mutation_id` (string, required)
- `items` (object[], required)
- `customer_id` (string | null)
- `customer_name` (string)
- `coupon_code` (string | null)
- `global_discount_pct` (number | null)
- `notes` (string)
- `patient_national_id` (string)
- `doctor_license` (string)

Request body example:

```json
{
  "client_mutation_id": "string",
  "items": [
    {
      "medicine_id": "string",
      "quantity": 1,
      "unit_price": 0
    }
  ],
  "customer_id": "string",
  "customer_name": "string",
  "coupon_code": "string",
  "global_discount_pct": 0,
  "notes": "",
  "patient_national_id": "",
  "doctor_license": ""
}
```

**Responses**

- `200` — Operation completed
- `201` — Record created
- `400` — Invalid request
- `401` — Session expired or revoked
- `403` — Permission denied or self-approval
- `409` — Record changed or no longer actionable
- `423` — Register locked