---
title: Hosted endpoints
summary: The four page-handler endpoints NDReimbursementWebApp exposes to its own browser scripts and forms, with their security posture.
status: generated
owner: SAIF Case Management
last_reviewed: 2026-10-20
---

# Hosted endpoints

NDReimbursementWebApp is a Razor Pages application. It does not publish an API: it has no API controllers and no minimal API route groups. The only HTTP endpoints it hosts are page handlers on the single `NDReimbursement` page, and the only caller is the [NDReimbursement](../screens/ndreimbursement.md) screen. Every handler is subject to the page-level `[SecurityApiAuthorize]` role list for the four NDR roles ([BR-APP-001](business-rules.md#br-app-001)) †, and every handler runs with anti-forgery validation turned off ([BR-APP-006](business-rules.md#br-app-006)).

The page is served under the path base `/NDReimbursementWebApp` ([BR-APP-008](business-rules.md#br-app-008)). Paths below are relative to that base.

## Endpoint catalog

### POST NDReimbursementHandlerUpdateReimbursements

| Field | Value |
| --- | --- |
| Path | `POST /NDReimbursement?handler=UpdateReimbursements` |
| Request | JSON body of type `ReimbursementsUpdate` containing the modified claims |
| Response | JSON `{ success: true }`, or `{ success: false }` when an exception is caught |
| Authorization | Page role list †; no handler-level check ([BR-APP-003](business-rules.md#br-app-003)) |
| Anti-forgery | Disabled ([BR-APP-006](business-rules.md#br-app-006)) |
| Called from | [NDReimbursement](../screens/ndreimbursement.md), the Save button in `wwwroot/js/ClaimsTable.js` |
| Behavior | Maps each modified claim to the API-client contract and calls `UpdateClaimAsync` of `NDReimbursementAPI.Client` (known from the call site; package internals unknown**). The audit user name is taken from the request, not the authenticated user (TD-APP-005). |

### POST NDReimbursementHandlerPayOnline

| Field | Value |
| --- | --- |
| Path | `POST /NDReimbursement/PayOnline` (the screen script uses the route-segment form; the `?handler=PayOnline` form is equivalent) |
| Request | Form-urlencoded `totalAmount`, `maxAmount`, `policyNum` |
| Response | JSON OneInc payment request, or null when validation fails ([BR-SCR-007](business-rules.md#br-scr-007)) |
| Authorization | Page role list †; no handler-level check |
| Anti-forgery | Disabled ([BR-APP-006](business-rules.md#br-app-006)) |
| Called from | [NDReimbursement](../screens/ndreimbursement.md), `$.post` in `wwwroot/js/PaymentModal.js` |
| Behavior | Checks `0 < total <= max` and creates the payment request through `OneIncService` and `OneIncAPIClient` (known from the call site; package internals unknown**). A caught exception also returns null. `maxAmount` and `policyNum` come from the client (TD-APP-006). |

### POST NDReimbursementHandlerPayByMail

| Field | Value |
| --- | --- |
| Path | `POST /NDReimbursement?handler=PayByMail` |
| Request | Form post from the Pay by mail button |
| Response | File download, `application/pdf`; on failure the handler sets `IsSuccessful` false and `ErrorMessage` and re-renders the page; the view displays the message only when `!IsSuccessful && !HasPolicyNumber` |
| Authorization | Page role list †; no handler-level check |
| Anti-forgery | Disabled ([BR-APP-006](business-rules.md#br-app-006)) |
| Called from | [NDReimbursement](../screens/ndreimbursement.md), the Pay by mail button in `Pages/NDReimbursement.cshtml` |
| Behavior | Fetches the statement print XML through `GetOnlinePrintStatementXML`, renders a PDF through `IDocumentsCoreClient.GeneratePreview` (both known from call sites; package internals unknown**), and writes the bytes to the response. The write omits the last byte (`Preview.Length - 1`, TD-APP-009), as does the download statement handler. |

### POST NDReimbursementHandlerDownloadStatement

| Field | Value |
| --- | --- |
| Path | `POST /NDReimbursement?handler=DownloadStatement` |
| Request | Form post from the download form |
| Response | PDF file download (`application/pdf`) on success; when the preview payload is not a string or an exception is caught, the handler sets `IsSuccessful` false and `ErrorMessage` and re-renders the page; the view displays the message only when `!IsSuccessful && !HasPolicyNumber` |
| Authorization | Page role list †; no handler-level check |
| Anti-forgery | Disabled ([BR-APP-006](business-rules.md#br-app-006)) |
| Called from | [NDReimbursement](../screens/ndreimbursement.md), the download form in `Pages/NDReimbursement.cshtml` |
| Behavior | Same print-XML and PDF-preview chain as pay by mail, returned as a file. Like pay by mail, the write omits the last byte of the PDF (`Preview.Length - 1`, TD-APP-009). |

## Summary

| Endpoint | Format | Anti-forgery | Called from |
| --- | --- | --- | --- |
| `UpdateReimbursements` | JSON | Disabled | [NDReimbursement](../screens/ndreimbursement.md) |
| `PayOnline` | JSON | Disabled | [NDReimbursement](../screens/ndreimbursement.md) |
| `PayByMail` | PDF | Disabled | [NDReimbursement](../screens/ndreimbursement.md) |
| `DownloadStatement` | PDF | Disabled | [NDReimbursement](../screens/ndreimbursement.md) |

The page model also contains handlers with no direct client script: reload context, policy number, statement, reimburse all, due date, developer access and delete statement. They are form posts from the same screen or have no caller in the shipped view; the delete form submits GET (no `method="post"`) and so cannot invoke `OnPostDeleteStatement` (TD-APP-007). Their anti-forgery posture is the same: disabled. The developer-access handler has no UI caller because its form is commented out (TD-APP-002).

> **Note:** Statements marked with `†` are derived from dependency library
> documentation via the Legends CLI. They describe inherited behavior from the indicated
> origin library and should be verified if the dependency version changes.

## Related documentation
- [Application index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Data model](data-model.md)
- [Security and authorization](security-authorization.md)
- [Business rules](business-rules.md)
- [Tech debt](tech-debt.md)
- [Screens index](../screens/index.md)

## Sources
- src/NDReimbursementWebApp/Pages/NDReimbursement.cshtml.cs
- src/NDReimbursementWebApp/Pages/NDReimbursement.cshtml
- src/NDReimbursementWebApp/wwwroot/js/ClaimsTable.js
- src/NDReimbursementWebApp/wwwroot/js/PaymentModal.js