> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Preflight the tenant's ledger routing configuration (admin) > Checks the caller tenant's ledger routing documents against the institution's ledger. For every organization with accounting routes enabled (routing.organizations): transaction and operation routes exist, the legs are members of the transaction route, their operation types, direct entries and account rules match, a ledger that validates account types has the block account type registered, and each flow of every configured ledger has a binding. An organization without routes is checked the same way, so it can be fixed before routes are turned on, but its lines are not_applicable unless its writes are refused without routes too (organization_routes_disabled). Every TRANSFER, with or without routes, needs a judicial deposit account: transfer.judicial_accounts for the legacy executor; in executor mode (the plugin) the institution's connector_metadata.executorLedger.judicialDepositAccountAlias, whose account must exist, unblocked, in the executor ledger. The executor-mode report reflects the STORED executorLedger; the running plugin keeps the one it loaded at boot until it restarts. The report never carries an account alias. The route is read-only: it never writes a document nor the ledger. Single-tenant (MULTI_TENANT_ENABLED=false) the institution is the required institutionId query parameter, with auth on or off, and the documents are the instance's single-tenant ones. Multi-tenant the tenant and institution are the validated token's tenantId, never the request; an institutionId that differs from it is refused with 403. Requires tenant_policy:read. ## OpenAPI ````yaml /pt/openapi/v3-current/sisbajud-executor.yaml get /v1/admin/ledger-routing/preflight openapi: 3.1.0 info: description: >- API for the Lerian SISBAJUD executor, which runs judicial orders on Midaz. It covers institution and Midaz connector configuration, orders that need attention, ledger-routing checks, credential key rotation and audit verification. title: Lerian SISBAJUD Executor API version: 1.0.0 servers: - url: https://api.example.com description: >- Replace the example host with the URL provided during environment onboarding. security: - BearerAuth: [] tags: - description: >- Institution configuration lifecycle: create (with key provisioning), read, and partial update of a connector configuration addressed by institution id. name: Institution - description: >- Rotation of the key that wraps an institution's stored connector credentials, addressed by institution id. name: Security - description: 'Admin API: audit-trail integrity verification.' name: Admin paths: /v1/admin/ledger-routing/preflight: get: tags: - Ledger Routing summary: Preflight the tenant's ledger routing configuration (admin) description: >- Checks the caller tenant's ledger routing documents against the institution's ledger. For every organization with accounting routes enabled (routing.organizations): transaction and operation routes exist, the legs are members of the transaction route, their operation types, direct entries and account rules match, a ledger that validates account types has the block account type registered, and each flow of every configured ledger has a binding. An organization without routes is checked the same way, so it can be fixed before routes are turned on, but its lines are not_applicable unless its writes are refused without routes too (organization_routes_disabled). Every TRANSFER, with or without routes, needs a judicial deposit account: transfer.judicial_accounts for the legacy executor; in executor mode (the plugin) the institution's connector_metadata.executorLedger.judicialDepositAccountAlias, whose account must exist, unblocked, in the executor ledger. The executor-mode report reflects the STORED executorLedger; the running plugin keeps the one it loaded at boot until it restarts. The report never carries an account alias. The route is read-only: it never writes a document nor the ledger. Single-tenant (MULTI_TENANT_ENABLED=false) the institution is the required institutionId query parameter, with auth on or off, and the documents are the instance's single-tenant ones. Multi-tenant the tenant and institution are the validated token's tenantId, never the request; an institutionId that differs from it is refused with 403. Requires tenant_policy:read. operationId: get-ledger-routing-preflight parameters: - description: >- Institution to preflight (UUID). Required single-tenant (MULTI_TENANT_ENABLED=false), where one instance hosts many institutions. Multi-tenant the institution is the validated token's tenantId; when sent it must equal that tenant, otherwise the request is refused with 403. explode: false in: query name: institutionId schema: description: >- Institution to preflight (UUID). Required single-tenant (MULTI_TENANT_ENABLED=false), where one instance hosts many institutions. Multi-tenant the institution is the validated token's tenantId; when sent it must equal that tenant, otherwise the request is refused with 403. examples: - 0196a1b2-0000-7000-8000-000000000001 type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/LedgerRoutingPreflightResponse' description: OK '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Internal Server Error default: content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Error components: schemas: LedgerRoutingPreflightResponse: additionalProperties: false properties: documentState: description: >- Shape of the tenant's ledger bindings document (tenant_policy/routing.ledger_bindings): sentinel is the unconfigured {} default, empty has no binding, bindings has at least one, invalid is a stored document that does not parse. enum: - sentinel - empty - bindings - invalid examples: - bindings type: string judicialAccountsDocumentState: description: >- Shape of the tenant's transfer.judicial_accounts document, which holds the judicial deposit account of each organization and ledger for the legacy executor: sentinel is the {} default (no account), empty has no entry, entries has at least one, invalid does not parse. In executor mode the plugin does not use it, and invalid does not block the report. enum: - sentinel - empty - entries - invalid examples: - entries type: string lines: description: >- One line per binding, plus one per flow or organization the connector writes to that has no binding or judicial account (covered=false). No line carries an account alias. items: $ref: '#/components/schemas/LedgerRoutingPreflightLine' type: - array - 'null' organizationsDocumentState: description: >- Shape of the tenant's routing.organizations document, which enables accounting routes per organization: sentinel is the {} default (no organization uses routes), empty has no entry, entries has at least one, invalid does not parse. enum: - sentinel - empty - entries - invalid examples: - entries type: string ready: description: >- True only when the documents the run uses parse (in executor mode transfer.judicial_accounts is not used), every line is ok or not_applicable and, when some organization has routes enabled, the bindings document carries bindings. examples: - false type: boolean required: - documentState - organizationsDocumentState - judicialAccountsDocumentState - ready - lines type: object Detail: additionalProperties: true properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object LedgerRoutingPreflightLine: additionalProperties: false properties: covered: description: False when the flow or organization has no binding in the document. examples: - true type: boolean flowType: description: Ledger write the line covers; empty on the organization-level line. enum: - BLOCK - UNBLOCK - TRANSFER - '' examples: - BLOCK type: string ledgerId: description: Midaz ledger id; empty on the organization-level line. examples: - 0196a1b2-0000-7000-8000-0000000000b1 type: string ledgerValidateRoutes: description: >- The ledger's accounting.validateRoutes setting; absent when it was not read or the read failed. examples: - true type: boolean membership: description: >- Whether the operation routes were checked against the transaction route's member list. enum: - verified - unverified - not_applicable examples: - verified type: string mode: description: Binding mode; absent on coverage lines (covered=false). enum: - routes - omit examples: - routes type: string organizationId: description: Midaz organization id. examples: - 0196a1b2-0000-7000-8000-0000000000a1 type: string reasons: description: >- Failed rules, in a fixed order; empty when the line passes. In executor mode (the plugin) the TRANSFER judicial account checks read the institution's connector_metadata.executorLedger instead of transfer.judicial_accounts: executor_judicial_account_missing or executor_judicial_account_invalid name its judicialDepositAccountAlias field (never the value), judicial_account_not_found that its account is not in the ledger, judicial_account_blocked that it is there but blocked (both refuse every plugin TRANSFER); executor_ledger_config_invalid and executor_institution_not_owned are carried by a line without flowType. items: enum: - transaction_route_not_found - source_route_not_found - destination_route_not_found - midaz_unavailable - source_not_member - destination_not_member - transaction_route_extra_members - source_operation_type - destination_operation_type - source_direct_entry_missing - destination_direct_entry_missing - block_account_rule - deposit_alias_rule - binding_not_found - organization_not_bound - organization_not_configured - omit_on_validating_ledger - block_account_type_not_registered - judicial_account_not_configured - executor_judicial_account_missing - executor_judicial_account_invalid - judicial_account_not_found - judicial_account_blocked - executor_ledger_config_invalid - executor_institution_not_owned - organization_routes_disabled - connector_unavailable - connector_not_midaz type: string type: - array - 'null' routesEnabled: description: >- The organization's accountingRoutesEnabled in routing.organizations; false means its writes post without routes and its bindings are not used. examples: - true type: boolean verdict: description: >- Line outcome, by precedence unavailable > missing > mismatched > ok; not_applicable for omit bindings, unconfigured organizations and organizations without routes whose writes nothing refuses. enum: - ok - missing - mismatched - unavailable - not_applicable examples: - ok type: string required: - organizationId - ledgerId - flowType - covered - routesEnabled - verdict - membership - reasons type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.