circuit API

allow to filter on usernames when
asking the list of cash-out operations.

1 files changed, 16 insertions, 3 deletions

diff --git a/libeufin/api-sandbox.rst b/libeufin/api-sandbox.rst
index c9b9561f..3b1a39c8 100644
--- a/libeufin/api-sandbox.rst
+++ b/libeufin/api-sandbox.rst
@@ -442,6 +442,15 @@ Cashouts
 .. http:get:: /cashouts
 
   Returns the list of all the (pending and confirmed) cash-out operations.
+  Ordinary users can only use this endpoint to learn their *own* cash-out
+  operations.
+
+  **Request:**
+  
+  :query account: *Optional.*
+    Filters the request to only get the cash-out operations related to
+    the account specified in this parameter.  Ordinary users must use
+    this option and pass their own username as the value.
 
   **Response:**
 
@@ -452,12 +461,16 @@ Cashouts
       cashouts: string[]; 
     }
 
-  :http:statuscode:`204 No Content`:
-    No cash-out operations were found at the bank
-
   :http:statuscode:`200 OK`:
     At least one cash-out operation was found.
 
+  :http:statuscode:`204 No Content`:
+    No cash-out operations were found at the bank
+
+  :http:statuscode:`403 Forbidden`:
+    A ordinary user invoked this call either without
+    the ``account`` parameter or by passing to it someone
+    else's username.
 
 .. http:get:: /cashouts/$cashoutId