NDReimbursementWebApp is a Razor Pages application. It does not publish an API: it has no API controllers and no minimal API route groups. The only HTTP endpoints it hosts are page handlers on the single NDReimbursement page, and the only caller is the NDReimbursement screen. Every handler is subject to the page-level [SecurityApiAuthorize] role list for the four NDR roles (BR-APP-001) †, and every handler runs with anti-forgery validation turned off (BR-APP-006).
The page is served under the path base /NDReimbursementWebApp (BR-APP-008). Paths below are relative to that base.
NDReimbursement, the Save button in wwwroot/js/ClaimsTable.js
Behavior
Maps each modified claim to the API-client contract and calls UpdateClaimAsync of NDReimbursementAPI.Client (known from the call site; package internals unknown**). The audit user name is taken from the request, not the authenticated user (TD-APP-005).
Checks 0 < total <= max and creates the payment request through OneIncService and OneIncAPIClient (known from the call site; package internals unknown**). A caught exception also returns null. maxAmount and policyNum come from the client (TD-APP-006).
File download, application/pdf; on failure the handler sets IsSuccessful false and ErrorMessage and re-renders the page; the view displays the message only when !IsSuccessful && !HasPolicyNumber
NDReimbursement, the Pay by mail button in Pages/NDReimbursement.cshtml
Behavior
Fetches the statement print XML through GetOnlinePrintStatementXML, renders a PDF through IDocumentsCoreClient.GeneratePreview (both known from call sites; package internals unknown**), and writes the bytes to the response. The write omits the last byte (Preview.Length - 1, TD-APP-009), as does the download statement handler.
PDF file download (application/pdf) on success; when the preview payload is not a string or an exception is caught, the handler sets IsSuccessful false and ErrorMessage and re-renders the page; the view displays the message only when !IsSuccessful && !HasPolicyNumber
NDReimbursement, the download form in Pages/NDReimbursement.cshtml
Behavior
Same print-XML and PDF-preview chain as pay by mail, returned as a file. Like pay by mail, the write omits the last byte of the PDF (Preview.Length - 1, TD-APP-009).
The page model also contains handlers with no direct client script: reload context, policy number, statement, reimburse all, due date, developer access and delete statement. They are form posts from the same screen or have no caller in the shipped view; the delete form submits GET (no method="post") and so cannot invoke OnPostDeleteStatement (TD-APP-007). Their anti-forgery posture is the same: disabled. The developer-access handler has no UI caller because its form is commented out (TD-APP-002).
Note: Statements marked with † are derived from dependency library
documentation via the Legends CLI. They describe inherited behavior from the indicated
origin library and should be verified if the dependency version changes.