---
title: Open a bill from the inbox
summary: A user works the personal inbox and opens one of its bills on the Bill entry screen.
status: draft
owner: Claims
last_reviewed: 2026-09-30
operation_id: open-bill-from-inbox
trigger: User opens the Inbox and double-clicks a bill row
---

# Open a bill from the inbox

A user works the personal inbox and opens one of its bills on the Bill entry screen.

## Trigger and screens

| Item | Detail |
| --- | --- |
| Trigger | User opens the Inbox and double-clicks a bill row |
| Screens | [Inbox](../../screens/inbox.md), [Bill entry](../../screens/entry.md) |
| Tables | Not traced** |

## Steps

1. The user opens the Inbox (`Inbox.Index`).
   1. The action takes the Session `MailId` or the current user id, upper-cased, as the responsible party ([BR-SCR-011](../business-rules.md#br-scr-011-inbox-owner-defaults-to-current-user)).
   2. It loads the "Inbox" grid preferences through `BaseController.GetPreferences`, which reads them from the user profile service.
2. The grid calls [Inbox.GetInboxBills](../hosted-endpoints.md#inbox.getinboxbills).
   1. A blank or `SYSTEM` mail id is replaced by the current user id, and the result is stored in Session `MailId` ([BR-SCR-011](../business-rules.md#br-scr-011-inbox-owner-defaults-to-current-user)).
   2. The action calls `IUserProfileService.GetApplicationUser` for the responsible party and formats the contact name with `FormatToStandardFirst` to fill `UserName`.
   3. The action calls `IBillEntryService.GetInboxBillsByResponsiblePartyId` with the upper-cased id and maps the returned `InboxItems` to `InboxBillViewModel` rows with AutoMapper.
   4. When the result is flagged `SecurityFiltered`, the action adds the warning "Warning: One or more of these claims is confidential and does not appear in the list." ([BR-SCR-012](../business-rules.md#br-scr-012-inbox-warns-on-confidential-claims-and-unknown-users)).
   5. The action returns the grid data with `MailIdName`, `SecureMessage` and `UserName`; the client warns on an unknown user id ([BR-SCR-012](../business-rules.md#br-scr-012-inbox-warns-on-confidential-claims-and-unknown-users)).

   > **Origin**: Steps 1.2 and 2.2–2.3 are the controller-side calls to `IUserProfileService` in `SAIF.Framework.Core`† (per the Legends CLI RAG service, a profile-resolution contract exposing `GetApplicationUser`, `GetCurrentUser`, and related lookup members) and to `IBillEntryService` in `SAIF.SAIFCode.Core`†, a contracts-only interface whose implementation lives outside that library and was not traced by this run*.
3. The Save and Clear preference links post to [BaseController.SavePreferences](../hosted-endpoints.md#basecontroller.savepreferences) and [BaseController.ClearPreferences](../hosted-endpoints.md#basecontroller.clearpreferences). The actions store or remove the `ColumnSort`, `ColumnOrder` and `ColumnWidths` values for the page through the current user's preferences and return nothing.
4. The user double-clicks a row. The client checks the bill status and allows only Pending, Entered, Audited or Suspended ([BR-SCR-001](../business-rules.md#br-scr-001-bills-must-be-in-an-openable-status)).
5. The browser navigates to `/ClaimBillEntry/Entry/Index/{billId}`.
   1. `Entry.Index` loads the diagnosis and procedure type lists through `IBillDiagnosisService.GetDiagnosisTypeCodes` and `IBillProcedureService.GetPrimaryProcedureCodes`.
   2. It reads the queue count with `IBillEntryService.GetClaimBillQueueRemainingCount` and the bill type codes with `IBillEntryService.GetBillTypeCodes`.
   3. It sets `CanDiscardBill` from the `CBEDiscardBill` permission ([BR-SCR-006](../business-rules.md#br-scr-006-discard-permission-is-enforced-client-side-only)).
6. The Bill entry screen calls [Entry.GetBill](../hosted-endpoints.md#entry.getbill).
   1. The action calls `IBillEntryService.GetBill`. A bill that is not updateable is refused with "Only Pending, Entered, Audited, or Suspended bills may be opened." ([BR-SCR-001](../business-rules.md#br-scr-001-bills-must-be-in-an-openable-status)).
   2. The action calls `IClaimInformationService.GetClaimId` and `GetClaimSecurity`. For a conflict claim it requires the `ConflictClaim` permission ([BR-SCR-002](../business-rules.md#br-scr-002-conflict-claim-bills-require-conflictclaim-permission)).
   3. The action maps the bill to the entry view model and adds the queue count.

   > **Origin**: Steps 5.1–5.2 and 6.1–6.2 are the controller-side calls to `IBillDiagnosisService`, `IBillProcedureService`, `IBillEntryService` and `IClaimInformationService` in `SAIF.SAIFCode.Core`†. Per the Legends CLI RAG service, `SAIF.SAIFCode.Core` is a contracts-only library and these interfaces' implementations live outside it (most likely `SAIF.Services`), which this run did not trace*.
7. The screen fills the header, grids and notes; procedure types are mapped for display ([BR-SCR-010](../business-rules.md#br-scr-010-procedure-type-maps-to-principal-or-other)).

## Process flow

The diagram shows the main path and its decision points.

```mermaid
flowchart TD
    A["Open Inbox<br>(Session MailId or current user)"] --> B["Resolve mail id<br>(default to current user)"]
    B --> B1["GetApplicationUser<br>(owner name)"]
    B1 --> C["GetInboxBillsByResponsiblePartyId<br>fills the grid"]
    C --> D{"Bill status openable?"}
    D -->|"No"| X["Show status error"]
    D -->|"Yes"| E["Navigate to Entry/Index/id"]
    E --> F["Entry.Index, then Entry.GetBill<br>(GetBill, GetClaimSecurity)"]
    F --> G{"Conflict claim and<br>no ConflictClaim permission?"}
    G -->|"Yes"| Y["Show not authorized error"]
    G -->|"No"| H["Fill Bill entry screen"]
```

## Failure and edge-case behavior

- Bills in other statuses are refused on both the client and the server ([BR-SCR-001](../business-rules.md#br-scr-001-bills-must-be-in-an-openable-status)).
- A conflict-claim bill without the permission shows 'You are not authorized to view claim' ([BR-SCR-002](../business-rules.md#br-scr-002-conflict-claim-bills-require-conflictclaim-permission)).
- Hiding the Discard button is the only control on discarding ([BR-SCR-006](../business-rules.md#br-scr-006-discard-permission-is-enforced-client-side-only)).

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Hosted endpoints](../hosted-endpoints.md)
- [Data model](../data-model.md)
- [Architecture](../architecture.md)
- [Tech debt](../tech-debt.md)
- [Screen catalog](../../screens/index.md)

> **Note:** Statements marked with `†` are derived from dependency library
> documentation via the Legends CLI. Statements marked with `*` were inferred
> from code structure or contextual evidence. Statements marked with `**` could
> not be confirmed; treat as unknown until verified.

## Sources
- ClaimBillEntry/Controllers/InboxController.cs
- ClaimBillEntry/Controllers/EntryController.cs
- ClaimBillEntry/js/ClaimBillEntry.inbox.js
- ClaimBillEntry/Classes/AutoMapperBootStrapper.cs