Org Web Adapter

Editing pages/mmpy_252_allow_compliance_holds_to_be_created_via_api.org

:PROPERTIES:
:ID:       561cb3f2-1c77-4f04-82bc-7add24d052c1
:END:
#+title: MMPY-252 Allow compliance holds to be created via API

- source :: https://multimediallc.atlassian.net/browse/MMPY-252
- epic :: [[id:88adb9ec-ab52-4d87-8625-6cf72d01612c][MMPY-198 Compliance Holds, Fraud Holds, and Banned Payees]]
- tags ::  [[id:4b532967-a1d9-45f4-b1f0-9a02ad540ff0][Falcon Nest Project Story]] [[id:7c3bbb4e-d079-42c4-992c-3e76210911f4][Falcon Nest Project]]
- status ::  [[id:4d41d978-e56f-45c1-88d1-e2c76510972e][Status - Complete]]

* Description
In order to support an integration between payouts and the compliance tool, allow holds to be created via API.

* Requirement

** DONE Add compliance holds to be created via API :mmpy252:holds:multimediallc:api:falcon:nest:feature:work:
:PROPERTIES:
:ID:       41ad3dcf-e3d1-ef33-9957-bcad0d0a603f
:END:
** DONE Add  tests for compliance holds to be created via API :mmpy252:tests:holds:multimediallc:api:falcon:nest:feature:work:
:PROPERTIES:
:ID:       5232232c-a955-7798-1574-a406e2199fe8
:END:
** DONE Make sure we use existing hold check flow :mmpy252:holds:multimediallc:api:falcon:nest:feature:work:
:PROPERTIES:
:ID:       57a2c639-8219-71a3-0504-56f85bf4b9e4
:END:
** DONE Clean up issues from PR review :mmpy252:holds:multimediallc:prreview:api:falcon:nest:feature:work:

:PROPERTIES:
:ID:       811e9be8-a954-2e36-263e-6b8039ad9937
:END:

- Note taken on [2025-08-06 Wed 12:41]

Just cleaning up tests now. I figured out a cludgy way to get a user from the
  API calls using a "calling_user" parameter. It works, but it's not great.
  There's no security, as anyone could overwrite the sending parameters. But
  that's also not our chief concern. Mostly it's just for auditing purposes.

** DONE Swap out PATCH on user with a proper Hold viewset :mmpy252:holds:feature:multimediallc:api:falcon:nest:work:project:
:PROPERTIES:
:ID:       7d73adbd-e4b2-db8c-f907-4ec612612956
:END:
** GIVEN

An admin scoped API request

** WHEN

A compliance hold is PATCH is submitted for a specific user ID

** THEN

Allow the hold to be closed, no other editing is allowed

Fields:
- ID of the hold
- Notes [OPTIONAL]
- Removed by - username not fk?  if we use a django admin user for the created by via api, this field is not included.