SPAY4 · CURRENT AUTHORITY

BO 菜單－API 實作進度

CURRENT

23 個 menu code 以 runtime policy catalog 呈現 B/F/R 與已確認 API。

只列 controller 或 accepted/current contract 已證實的 endpoint；endpoint 存在不代表 menu 已啟用。

僅以 runtime catalog 作為 menu metadata 與 B/F/R authority。

每張 card 顯示可見 principal、policy action、B/F/R 與已確認 API。controller evidence 表示 handler 已有 @RequireBackofficePolicy；contract evidence 尚未代表 menu policy integration 或可用性。

23全部 menu
16已就緒
1後端已實作、未啟用
0契約／接線待完成
6待契約定義

需登入、免 resource-action grant API

下列 API 都必須帶有效 Bearer JWT／formal session；它們不是匿名公開 API，但不要求對應的 application-level resource-action grant。

MethodPathGrant requirement行為證據
GET/bo/v2/menu不需 AUTH_MENU_BOOTSTRAP:VIEW需有效 Bearer JWT／formal session；每次由 fresh server-side authorization 或 fixed Supply profile 重新解析目前 principal 的 menu projection，menu 不是 endpoint authorization。controller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AuthController.java
GET/bo/v2/agents/options不需 AGENT_MANAGEMENT:VIEW需有效 Bearer JWT／formal session；只回傳 active Agent 的 identity 與 Prefix display option，固定依 id ASC 排序。controller · spay4-bo/src/main/java/com/sit/spay4/agent/controller/AgentController.java
GET/bo/v2/banks/options不需 BANK_MANAGEMENT:VIEW需有效 Bearer JWT／formal session；只回傳 active Bank 的安全 selector projection，固定依 code ASC 排序。controller · spay4-bo/src/main/java/com/sit/spay4/masterdata/controller/BankController.java
GET/bo/v2/config/definitions不需 SYSTEM_CONFIGURATION:VIEW需有效 Bearer JWT／formal session；只回傳受管理設定的 key 與說明，不回傳設定值或覆寫。controller · spay4-bo/src/main/java/com/sit/spay4/config/controller/ConfigController.java

Admin Management 5 個 menu

AGENT_MANAGEMENT

Prefix List

已就緒
Principal
SUPERADMIN, PREFIX
允許 action
VIEW, INSERT, UPDATE, DELETE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/agents/meVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/agent/controller/AgentController.java
GET/bo/v2/agents/listVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/agent/controller/AgentController.java
GET/bo/v2/agents/pageVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/agent/controller/AgentController.java
GET/bo/v2/agents/{agentId}VIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/agent/controller/AgentController.java
POST/bo/v2/agentsINSERTcontroller · spay4-bo/src/main/java/com/sit/spay4/agent/controller/AgentController.java
PUT/bo/v2/agents/{agentId}/statusUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/agent/controller/AgentController.java
PUT/bo/v2/agents/{agentId}/callback-urlUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/agent/controller/AgentController.java
PUT/bo/v2/agents/{agentId}/banksUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/agent/controller/AgentController.java
PUT/bo/v2/agents/{agentId}/credentials/externalOrderApiUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/agent/controller/AgentController.java
GET/bo/v2/agents/{agentId}/credentials/lineVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/agent/controller/AgentController.java
PUT/bo/v2/agents/{agentId}/credentials/line/{notificationProviderSourceId}UPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/agent/controller/AgentController.java

ACCESS_ROLE_MANAGEMENT

Admin Role Management

已就緒
Principal
SUPERADMIN
允許 action
VIEW, INSERT, UPDATE, DELETE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/access/rolesVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessRoleController.java
GET/bo/v2/access/role-assignmentsVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessRoleController.java
GET/bo/v2/access/roles/{roleId}VIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessRoleController.java
GET/bo/v2/access/permission-resourcesVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessRoleController.java
POST/bo/v2/access/rolesINSERTcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessRoleController.java
PUT/bo/v2/access/roles/{roleId}UPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessRoleController.java
PUT/bo/v2/access/roles/{roleId}/statusUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessRoleController.java
PUT/bo/v2/access/role-assignments/{userId}UPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessRoleController.java
DELETE/bo/v2/access/roles/{roleId}DELETEcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessRoleController.java

ACCESS_USER_MANAGEMENT

Admin Account Management

已就緒
Principal
SUPERADMIN
允許 action
VIEW, INSERT, UPDATE, DELETE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/access/usersVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessUserController.java
GET/bo/v2/access/users/{userId}VIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessUserController.java
POST/bo/v2/access/usersINSERTcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessUserController.java
PUT/bo/v2/access/users/{userId}UPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessUserController.java
PUT/bo/v2/access/users/{userId}/statusUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessUserController.java
DELETE/bo/v2/access/users/{userId}DELETEcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AccessUserController.java
POST/bo/v2/auth/users/{userId}/password/resetUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AuthPasswordController.java

SUPPLIER_ACCOUNT_LIST

Supplier Account List

已就緒
Principal
SUPERADMIN, SUPPLIER
允許 action
VIEW, INSERT, UPDATE, DELETE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/supplierAccountsVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplierAccountController.java
GET/bo/v2/supplierAccounts/{accountId}VIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplierAccountController.java
POST/bo/v2/supplierAccountsINSERTcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplierAccountController.java
PUT/bo/v2/supplierAccounts/{accountId}/statusUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplierAccountController.java
DELETE/bo/v2/supplierAccounts/{accountId}DELETEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplierAccountController.java
POST/bo/v2/supplierAccounts/{accountId}/password/resetUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AuthPasswordController.java

GATEWAY_ACCOUNT_LIST

Gateway Account List

已就緒
Principal
SUPERADMIN, SUPPLIER
允許 action
VIEW, INSERT, UPDATE, DELETE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/gatewayAccountsVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/GatewayAccountController.java
GET/bo/v2/gatewayAccounts/{accountId}VIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/GatewayAccountController.java
POST/bo/v2/gatewayAccountsINSERTcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/GatewayAccountController.java
PUT/bo/v2/gatewayAccounts/{accountId}/statusUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/GatewayAccountController.java
DELETE/bo/v2/gatewayAccounts/{accountId}DELETEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/GatewayAccountController.java
POST/bo/v2/gatewayAccounts/{accountId}/password/resetUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AuthPasswordController.java

User Management 4 個 menu

BANK_MANAGEMENT

Bank Management

已就緒
Principal
SUPERADMIN
允許 action
VIEW, INSERT, UPDATE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/banks/pageVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/masterdata/controller/BankController.java
GET/bo/v2/banks/currency/{currencyId}VIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/masterdata/controller/BankController.java
POST/bo/v2/banksINSERTcontroller · spay4-bo/src/main/java/com/sit/spay4/masterdata/controller/BankController.java
PUT/bo/v2/banks/{bankId}UPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/masterdata/controller/BankController.java
PUT/bo/v2/banks/{bankId}/statusUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/masterdata/controller/BankController.java

NOTIFICATION_PROVIDER_SOURCE

Line Provider

已就緒
Principal
SUPERADMIN
允許 action
VIEW, INSERT, UPDATE, DELETE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/notificationProviderSources/pageVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/masterdata/controller/NotificationProviderSourceController.java
GET/bo/v2/notificationProviderSources/{sourceId}VIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/masterdata/controller/NotificationProviderSourceController.java
POST/bo/v2/notificationProviderSourcesINSERTcontroller · spay4-bo/src/main/java/com/sit/spay4/masterdata/controller/NotificationProviderSourceController.java
PUT/bo/v2/notificationProviderSources/{sourceId}UPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/masterdata/controller/NotificationProviderSourceController.java
PUT/bo/v2/notificationProviderSources/{sourceId}/statusUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/masterdata/controller/NotificationProviderSourceController.java
DELETE/bo/v2/notificationProviderSources/{sourceId}DELETEcontroller · spay4-bo/src/main/java/com/sit/spay4/masterdata/controller/NotificationProviderSourceController.java

SUPPLY_CARDHOLDER_OVERVIEW

Cardholder Overview

後端已實作、未啟用
Principal
SUPERADMIN, SUPPLIER, GATEWAY
允許 action
VIEW, INSERT
B / F / R
— / — / —

已確認 API

MethodPathPolicy action證據
POST/bo/v2/paymentAccountsINSERTcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/PaymentAccountController.java

未完成原因：Payment Account onboarding handler 已存在，但此 menu resource 尚未 B/F/R-ready，不得視為可用菜單。

SUPPLY_CARDHOLDER_MANAGEMENT

Cardholder Management

已就緒
Principal
SUPERADMIN, SUPPLIER, GATEWAY
允許 action
VIEW, INSERT, UPDATE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/supplyCardholdersVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplyCardholderController.java
GET/bo/v2/supplyCardholders/{cardholderId}VIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplyCardholderController.java
POST/bo/v2/supplyCardholdersINSERTcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplyCardholderController.java
PUT/bo/v2/supplyCardholders/{cardholderId}UPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplyCardholderController.java
PUT/bo/v2/supplyCardholders/{cardholderId}/statusUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplyCardholderController.java

Transaction Management 1 個 menu

HOUSE_TRANSACTION_WORKSPACE

Transaction Record

已就緒
Principal
SUPERADMIN, PREFIX
允許 action
VIEW, UPDATE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/houseCardTransactions/pageVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/HouseCardTransactionController.java
GET/bo/v2/houseCardTransactions/{transactionId}VIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/HouseCardTransactionController.java
GET/bo/v2/houseCardTransactions/{transactionId}/raw-contentVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/HouseCardTransactionController.java
GET/bo/v2/houseCardTransactions/{transactionId}/manualMatch/candidatesVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/HouseCardTransactionController.java
PUT/bo/v2/houseCardTransactions/{transactionId}/manualMatchUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/HouseCardTransactionController.java

Order Management 3 個 menu

SUPPLY_DEPOSIT_WORKSPACE

Deposit List

待契約定義
Principal
SUPERADMIN, SUPPLIER, GATEWAY
允許 action
VIEW
B / F / R
— / — / —

已確認 API

待契約定義：尚無可列出的已確認 API。

未完成原因：尚無可列出的已確認 API。

DEPOSIT_WORKSPACE

Deposit List

待契約定義
Principal
PREFIX
允許 action
VIEW
B / F / R
— / — / —

已確認 API

待契約定義：尚無可列出的已確認 API。

未完成原因：尚無可列出的已確認 API。

SUPPLY_WITHDRAWAL_WORKSPACE

Withdrawal List

待契約定義
Principal
SUPERADMIN, SUPPLIER, GATEWAY
允許 action
VIEW
B / F / R
— / — / —

已確認 API

待契約定義：尚無可列出的已確認 API。

未完成原因：尚無可列出的已確認 API。

Payment Management 6 個 menu

SUPPLIER_SETTING

Supplier Setting

已就緒
Principal
SUPERADMIN
允許 action
VIEW, INSERT, UPDATE, DELETE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/suppliersVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplierController.java
GET/bo/v2/suppliers/{supplierId}VIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplierController.java
POST/bo/v2/suppliersINSERTcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplierController.java
PUT/bo/v2/suppliers/{supplierId}UPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplierController.java
PUT/bo/v2/suppliers/{supplierId}/statusUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplierController.java
DELETE/bo/v2/suppliers/{supplierId}DELETEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplierController.java

SUPPLY_GATEWAY

Gateway Setting

已就緒
Principal
SUPERADMIN, SUPPLIER, GATEWAY
允許 action
VIEW, INSERT, UPDATE, DELETE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/supplyGatewaysVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplyGatewayController.java
GET/bo/v2/supplyGateways/{gatewayId}VIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplyGatewayController.java
POST/bo/v2/supplyGatewaysINSERTcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplyGatewayController.java
PUT/bo/v2/supplyGateways/{gatewayId}/nameUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplyGatewayController.java
PUT/bo/v2/supplyGateways/{gatewayId}/operationalConfigUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplyGatewayController.java
DELETE/bo/v2/supplyGateways/{gatewayId}DELETEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplyGatewayController.java

SUPPLY_HOUSE_CARD

Prefix House Card

已就緒
Principal
SUPERADMIN, PREFIX
允許 action
VIEW, INSERT, UPDATE, DELETE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/houseCard/pageVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/HouseCardController.java
GET/bo/v2/houseCard/{houseCardId}VIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/HouseCardController.java
POST/bo/v2/houseCardINSERTcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/HouseCardController.java
PUT/bo/v2/houseCard/{houseCardId}UPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/HouseCardController.java
PUT/bo/v2/houseCard/{houseCardId}/statusUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/HouseCardController.java
DELETE/bo/v2/houseCard/{houseCardId}DELETEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/HouseCardController.java

SUPPLY_PT_RULE

PT Management

已就緒
Principal
SUPERADMIN, SUPPLIER, GATEWAY
允許 action
VIEW, UPDATE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/supplyPtRules/treeVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplyPtRuleController.java
GET/bo/v2/supplyPtRules/revisionsVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplyPtRuleController.java
PUT/bo/v2/supplyPtRules/{ownerType}/{ownerId}UPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/supply/controller/SupplyPtRuleController.java

SUPPLY_COMMISSION_REPORT

Pt Snapshot

待契約定義
Principal
SUPERADMIN, SUPPLIER, GATEWAY
允許 action
VIEW
B / F / R
— / — / —

已確認 API

待契約定義：尚無可列出的已確認 API。

未完成原因：尚無可列出的已確認 API。

COMMISSION_REPORT

Pt Snapshot

待契約定義
Principal
PREFIX
允許 action
VIEW
B / F / R
— / — / —

已確認 API

待契約定義：尚無可列出的已確認 API。

未完成原因：尚無可列出的已確認 API。

System Management 3 個 menu

SYSTEM_CONFIGURATION

System Configuration

已就緒
Principal
SUPERADMIN
允許 action
VIEW, UPDATE, DELETE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/configVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/config/controller/ConfigController.java
PUT/bo/v2/config/{key}UPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/config/controller/ConfigController.java
DELETE/bo/v2/config/{key}DELETEcontroller · spay4-bo/src/main/java/com/sit/spay4/config/controller/ConfigController.java

DOMAIN_AUDIT_LOG

Domain Audit Log

已就緒
Principal
SUPERADMIN, PREFIX, SUPPLIER, GATEWAY
允許 action
VIEW
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
GET/bo/v2/domainAudit/pageVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/audit/controller/DomainAuditLogController.java
GET/bo/v2/domainAudit/{id}VIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/audit/controller/DomainAuditLogController.java
GET/bo/v2/domainAudit/actionsVIEWcontroller · spay4-bo/src/main/java/com/sit/spay4/audit/controller/DomainAuditLogController.java

SYSTEM_NOTIFICATION_HISTORY

Notification

待契約定義
Principal
SUPERADMIN
允許 action
VIEW
B / F / R
— / — / —

已確認 API

待契約定義：尚無可列出的已確認 API。

未完成原因：尚無可列出的已確認 API。

My Profile 1 個 menu

RESET_PASSWORD

Reset Password

已就緒
Principal
SUPERADMIN, PREFIX, SUPPLIER, GATEWAY
允許 action
VIEW, UPDATE
B / F / R
✓ / ✓ / ✓

已確認 API

MethodPathPolicy action證據
PUT/bo/v2/auth/passwordUPDATEcontroller · spay4-bo/src/main/java/com/sit/spay4/auth/controller/AuthPasswordController.java

來源：backoffice-menu-api-progress.json 與 spay4-bo/.../BackofficePolicyCatalog.java。

圖片預覽