---
title: Hosted endpoints
summary: Named page handlers, partial fetches and API actions the application exposes to its own screens.
status: draft
owner: Policy Services Team
last_reviewed: 2026-09-09
---

# Hosted endpoints

These endpoints serve this application's own screens and are not a published API. They are listed here once so that each screen page can link to the request it makes.

## Endpoint catalog

### POST /Payroll/Reports?handler=Read

| Field | Value |
| --- | --- |
| Handler | `ReportsModel.OnPostReadAsync` |
| Kind | grid read |
| URL | `/Payroll/Reports?handler=Read` |
| Request | Form fields of the Kendo `DataSourceRequest` (`page`, `pageSize`, `sort`, `filter`) and the `policyNumber` route value |
| Response | `JsonResult` wrapping a `DataSourceResult` of `PayrollReportRow` |
| Anti-forgery | Validated by default; the grid `data` function sends the request verification token |
| Authorization | `[SecurityApiAuthorize("PolicyServices.Read,PolicyServices.Underwriting")]` declared on `BolPolicyModel`† |
| Called from | Payroll Reports |

### GET /Policy/Search?handler=Employers

| Field | Value |
| --- | --- |
| Handler | `SearchModel.OnGetEmployersAsync` |
| Kind | named handler JSON |
| URL | `/Policy/Search?handler=Employers` |
| Request | Query string `term` (`string`, at least three characters) |
| Response | `JsonResult` array of `{ employerId, employerName, policyNumber }`; an empty array when `term` is shorter than three characters |
| Anti-forgery | Not applicable; GET handlers are not validated |
| Authorization | `[SecurityApiAuthorize("PolicyServices.Read,PolicyServices.Underwriting")]` declared on `SearchModel` |
| Called from | Policy Search |

### GET /Policy/Summary?handler=Declaration

| Field | Value |
| --- | --- |
| Handler | `SummaryModel.OnGetDeclarationAsync` |
| Kind | file download |
| URL | `/Policy/Summary?handler=Declaration` |
| Request | Optional route value `policyNumber`; the policy number in `WebContext` is used when it is absent |
| Response | `FileStreamResult`, `application/pdf` |
| Anti-forgery | Not applicable; GET handlers are not validated |
| Authorization | `[SecurityApiAuthorize("PolicyServices.Read,PolicyServices.Underwriting")]` declared on `BolPolicyModel`† |
| Called from | [Policy Summary](../screens/policy-summary.md) |

### GET /Policy/Summary?handler=PayrollHistory

| Field | Value |
| --- | --- |
| Handler | `SummaryModel.OnGetPayrollHistoryAsync` |
| Kind | partial fetch |
| URL | `/Policy/Summary?handler=PayrollHistory` |
| Request | Query string `reportYear` (`int`, bound to `ReportYear`) |
| Response | `PartialViewResult` for `_PayrollHistory`; `400 Bad Request` when `reportYear` is not a year in the policy history |
| Anti-forgery | Not applicable; GET handlers are not validated |
| Authorization | `[SecurityApiAuthorize("PolicyServices.Read,PolicyServices.Underwriting")]` declared on `BolPolicyModel`† |
| Called from | [Policy Summary](../screens/policy-summary.md) |

## Summary

| Kind | Count |
| --- | --- |
| Named handler (JSON) | 1 |
| Named handler (partial) | 1 |
| File download | 1 |
| API controller / minimal API | 0 |
| Grid | 1 |
| Unattributed | 0 |

---

> [!NOTE]
> Statements marked with `*` are inferred from code patterns. Statements marked with `**` could not be verified from available source. Statements marked with `†` are sourced from package documentation retrieved with the Legends CLI.

## Related documentation
- Application index
- Architecture
- Security and authorization
- Screen catalog

## Sources
- src/SAIF.Policy.Portal/Pages/Payroll/Reports.cshtml.cs
- src/SAIF.Policy.Portal/Pages/Policy/Search.cshtml.cs
- src/SAIF.Policy.Portal/Pages/Policy/Summary.cshtml.cs