> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arcuserp.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Withdraw a pending period-close request
> Required API key scope: `accounting:close_period`
Withdraws a period-close request that has been raised but not yet
approved, returning the period from `pending_approval` to `open`.
**BOOKS-100 PERIOD-CLOSE-UNDO (2026-08-28).** Before this endpoint the
only exits from `pending_approval` were (a) a second person APPROVING
the request, which closes the period -- the opposite of what someone who
mis-clicked wants -- or (b) a raw `UPDATE`. And `pending_approval` is a
posting-blocking state, so one stray click froze a month of the ledger
with no in-product undo. This is the Rule 25 api-v1 twin of the
Cognito-JWT `POST /gl/periods/{id}/withdraw-close-request`; both call the
same canonical handler, so authorization and guards are identical.
**Authorization, two tiers (Rule 33 point 5 -- self-service on your OWN
record never requires the org permission):**
1. **Floor** -- `gl.close_period`, the permission that let you RAISE the
request in the first place. Gating the route itself on
`gl.approve_close` would lock the REQUESTER out of taking back their
own mis-click, which is the whole population this endpoint exists for.
2. **Plus** -- if the caller is NOT `close_requested_by`, they
additionally need `gl.approve_close`. Cancelling someone else's
request is an approval-authority act. Returns 403
`only_requester_or_approver_can_withdraw`.
**Guards:**
- **Layer 1 isolation** -- the period is scoped to the API key's
`entity_id`; cross-tenant attempts return 404.
- **State guard** -- only `pending_approval` periods can be withdrawn.
Returns 409 `period_not_in_pending_approval` with `current_status`.
- **Row lock** -- the state read takes `FOR UPDATE`, and the UPDATE
re-asserts `status = 'pending_approval'`, so a concurrent
`approve-close` cannot slip between the test and the flip. A lost race
returns 409 `period_state_changed`.
- **Audit log** (Rule 20) -- an `activity_log` row records the prior
state, the original requester, the withdrawing user, whether the
withdrawer WAS the requester, and the optional reason.
- **Broadcast** (Rule 13) -- `gl.period.close_request_withdrawn` is
emitted, mirroring the `gl.period.close_requested` event it undoes.
**Write surface is deliberately three columns and no more:** `status`
back to `open`, plus `close_requested_by` and `close_requested_at`
cleared. `close_approved_by` / `close_approved_at` /
`close_checksum_hex` are NOT touched -- on a `pending_approval` row they
are NULL by construction (approve-close writes them in the SAME
statement that flips status to `closed`), so writing them would be a
claim about state this handler has not measured.
## OpenAPI
````yaml /openapi.yaml post /periods/{id}/withdraw-close-request
openapi: 3.1.0
info:
title: Arcus ERP Public API
version: 1.0.0
description: >
Arcus ERP public REST API. Designed for external integrations and data
migration.
**Authentication.** Bearer token (API key) via the `Authorization` header.
Format: `Authorization: Bearer ark_live_ent__` (or
`ark_test_*` for sandbox).
API keys are issued per-entity in **Settings > Developers > API Keys**.
**Entity scoping.** The entity is encoded in the API key prefix; routes are
flat
(e.g. `/v1/accounts`, `/v1/orders`, `/v1/products`). A small set of platform
endpoints
(migration, reconciliation, events, webhook endpoints, API keys) use the
`/v1/entities/{entity_id}/...` form -- those are noted in their tags.
**Key capabilities.**
- Related-resource hydration via `?expand[]=` (see `x-arcus-expand` on each resource).
- Cursor-based pagination (`starting_after` / `ending_before` / `limit`).
- Idempotency via the `Idempotency-Key` header.
- Webhook events for asynchronous notification.
- Conditional requests / ETag for cache validation.
servers:
- url: https://api.arcuserp.com/v1
description: Arcus ERP API (accepts both live `ark_live_*` and test `ark_test_*` keys)
- url: https://dev-api.arcuserp.com/v1
description: >-
Dev sandbox API (test-only data, accepts `ark_test_*` keys against dev
RDS)
security: []
paths:
/periods/{id}/withdraw-close-request:
post:
tags:
- Accounting
summary: Withdraw a pending period-close request
description: >
Required API key scope: `accounting:close_period`
Withdraws a period-close request that has been raised but not yet
approved, returning the period from `pending_approval` to `open`.
**BOOKS-100 PERIOD-CLOSE-UNDO (2026-08-28).** Before this endpoint the
only exits from `pending_approval` were (a) a second person APPROVING
the request, which closes the period -- the opposite of what someone who
mis-clicked wants -- or (b) a raw `UPDATE`. And `pending_approval` is a
posting-blocking state, so one stray click froze a month of the ledger
with no in-product undo. This is the Rule 25 api-v1 twin of the
Cognito-JWT `POST /gl/periods/{id}/withdraw-close-request`; both call
the
same canonical handler, so authorization and guards are identical.
**Authorization, two tiers (Rule 33 point 5 -- self-service on your OWN
record never requires the org permission):**
1. **Floor** -- `gl.close_period`, the permission that let you RAISE the
request in the first place. Gating the route itself on
`gl.approve_close` would lock the REQUESTER out of taking back their
own mis-click, which is the whole population this endpoint exists for.
2. **Plus** -- if the caller is NOT `close_requested_by`, they
additionally need `gl.approve_close`. Cancelling someone else's
request is an approval-authority act. Returns 403
`only_requester_or_approver_can_withdraw`.
**Guards:**
- **Layer 1 isolation** -- the period is scoped to the API key's
`entity_id`; cross-tenant attempts return 404.
- **State guard** -- only `pending_approval` periods can be withdrawn.
Returns 409 `period_not_in_pending_approval` with `current_status`.
- **Row lock** -- the state read takes `FOR UPDATE`, and the UPDATE
re-asserts `status = 'pending_approval'`, so a concurrent
`approve-close` cannot slip between the test and the flip. A lost race
returns 409 `period_state_changed`.
- **Audit log** (Rule 20) -- an `activity_log` row records the prior
state, the original requester, the withdrawing user, whether the
withdrawer WAS the requester, and the optional reason.
- **Broadcast** (Rule 13) -- `gl.period.close_request_withdrawn` is
emitted, mirroring the `gl.period.close_requested` event it undoes.
**Write surface is deliberately three columns and no more:** `status`
back to `open`, plus `close_requested_by` and `close_requested_at`
cleared. `close_approved_by` / `close_approved_at` /
`close_checksum_hex` are NOT touched -- on a `pending_approval` row they
are NULL by construction (approve-close writes them in the SAME
statement that flips status to `closed`), so writing them would be a
claim about state this handler has not measured.
operationId: withdrawClosePeriodV1
parameters:
- name: id
in: path
required: true
schema:
type: string
format: uuid
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
reason:
type: string
description: >-
Optional free-text justification. Recorded verbatim in the
activity_log description and metadata. No length validation.
example: >-
Raised the close request by mistake while reviewing the
period.
responses:
'200':
description: Close request withdrawn; period returned to `open`.
content:
application/json:
schema:
type: object
properties:
data:
$ref: '#/components/schemas/AccountingPeriod'
'400':
description: 'Bad request (missing_field: entity_id or period_id absent)'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
'401':
$ref: '#/components/responses/Error'
'403':
description: >-
Forbidden (only_requester_or_approver_can_withdraw: caller is not
close_requested_by and lacks gl.approve_close)
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
'404':
$ref: '#/components/responses/Error'
'409':
description: >-
Conflict (period_not_in_pending_approval: status is not
'pending_approval'; period_state_changed: concurrent approve/close
won the race)
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
'422':
$ref: '#/components/responses/Error'
security:
- ApiKeyAuth: []
components:
schemas:
AccountingPeriod:
type: object
description: >
An accounting period. Closed periods refuse new journal entry postings
(Rule A3). Year-end closing entries that roll revenue and expense
activity into retained earnings are posted via a separate explicit
endpoint (POST /v1/accounting_periods/{id}/close-fiscal-year). The
monthly-period close does NOT by itself post a retained-earnings
rollover JE. Verified against live dev RDS
accounting.accounting_periods.
properties:
id:
type: string
format: uuid
readOnly: true
entity_id:
type: string
format: uuid
readOnly: true
period_name:
type: string
description: Human-readable name (e.g. 'January 2025')
start_date:
type: string
format: date
end_date:
type: string
format: date
status:
type: string
enum:
- open
- close_requested
- closed
readOnly: true
closed_by:
type: string
format: uuid
nullable: true
readOnly: true
closed_at:
type: string
format: date-time
nullable: true
readOnly: true
close_requested_by:
type: string
format: uuid
nullable: true
readOnly: true
close_requested_at:
type: string
format: date-time
nullable: true
readOnly: true
close_approved_by:
type: string
format: uuid
nullable: true
readOnly: true
close_approved_at:
type: string
format: date-time
nullable: true
readOnly: true
reopen_reason:
type: string
nullable: true
readOnly: true
description: >-
NEW-GAP-REOPEN-PERIOD-ENTITY-ISOLATION-SOD-REASON-AUDIT
(2026-05-15): operator-supplied justification from the most recent
reopen. 10-500 chars when set. Cleared on next close.
reopened_by:
type: string
format: uuid
nullable: true
readOnly: true
description: User who most recently reopened this period.
reopened_at:
type: string
format: date-time
nullable: true
readOnly: true
created_at:
type: string
format: date-time
readOnly: true
ErrorEnvelope:
type: object
description: |
Canonical error response envelope. All API errors use this shape.
required:
- error
- code
properties:
error:
type: string
description: Machine-readable error key
example: not_found
code:
type: string
description: Machine-readable error code (often same as error)
example: not_found
type:
type: string
enum:
- validation_error
- permission_error
- not_found
- conflict
- rate_limit
- internal
- expand_error
- not_implemented
example: not_found
hint:
type: string
description: Human-readable one-sentence explanation (English)
example: >-
The requested order does not exist or does not belong to this
entity.
param:
type: string
description: The parameter that caused the error, if applicable
example: expand[0]
required:
type: string
description: The scope required (only on insufficient_scope errors)
example: accounts:read
request_id:
type: string
description: >-
Unique request ID for support tracing (maps to CloudWatch log
stream)
example: req_abc123
responses:
Error:
description: Error response (400/401/403/404/409/422/429/500)
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
securitySchemes:
ApiKeyAuth:
type: http
scheme: bearer
description: |
API key issued per entity via Settings > Developers > API Keys.
Each key carries scopes (e.g. orders:read, products:write).
Bearer token format: Authorization: Bearer ark_live_ent__
Test keys use ark_test_ent__. Both are issued per entity
via Settings > Developers > API Keys.
````