Per-agent IRP5-equivalent annual withholding statement

GET 
/reports/regulator/ura/irp5/:agentId/:year

Aggregates every TaxPayable for the agent in the given year (regardless of remittance status). Compliance callers with compliance:financial:report can fetch any agent; agent callers with compliance:financial:report:own can only fetch their own agentId (403 otherwise). JSON shape suitable for downstream PDF rendering.

Request

Responses

200

401

Missing, malformed, or expired authentication token. Log in via POST /auth/login (or refresh via POST /auth/refresh) and retry with a fresh Authorization: Bearer <accessToken> header.

403

The authenticated caller does not carry the required permission or is scoped out of this resource by the object-authorization service (e.g. an agent trying to view another agent's referrals). Grant the missing permission via a role change or scope the query to resources the caller owns.

404

The referenced resource does not exist or is not visible to the caller. Note: object-level scoping is opaque — a resource you cannot see is indistinguishable from a resource that does not exist.

429

Rate limit exceeded. Global default is 120 requests/minute per IP; auth-flow, OTP, self-registration, WebAuthn, IRA lookup, and public-lead endpoints carry tighter per-endpoint limits. Retry after the delay indicated by the Retry-After header.

Response Headers

Retry-After

Seconds to wait before retrying.

500

Unhandled server error. The response carries a meta.requestId correlator you can hand to platform operations to trace the failure through structured logs and the hash-chained audit trail. Retry with the same Idempotency-Key header if the endpoint accepts idempotency.