Emit the IRA quarterly return as XML for portal upload

GET 
/reports/regulator/ira/quarterly/:id/xml

Structured skeleton that ops downloads, validates against the current IRA template, and uploads to the IRA portal. Snapshots the XML back to the report row for audit.

Request

Responses

200

401

Missing, malformed, or expired authentication token. Log in via POST /auth/login (or refresh via POST /auth/refresh) and retry with a fresh Authorization: Bearer <accessToken> header.

403

The authenticated caller does not carry the required permission or is scoped out of this resource by the object-authorization service (e.g. an agent trying to view another agent's referrals). Grant the missing permission via a role change or scope the query to resources the caller owns.

404

The referenced resource does not exist or is not visible to the caller. Note: object-level scoping is opaque — a resource you cannot see is indistinguishable from a resource that does not exist.

429

Rate limit exceeded. Global default is 120 requests/minute per IP; auth-flow, OTP, self-registration, WebAuthn, IRA lookup, and public-lead endpoints carry tighter per-endpoint limits. Retry after the delay indicated by the Retry-After header.

Response Headers

Retry-After

Seconds to wait before retrying.

500

Unhandled server error. The response carries a meta.requestId correlator you can hand to platform operations to trace the failure through structured logs and the hash-chained audit trail. Retry with the same Idempotency-Key header if the endpoint accepts idempotency.