> ## Documentation Index
> Fetch the complete documentation index at: https://docs.finsync.ar/llms.txt
> Use this file to discover all available pages before exploring further.

# List mesa candidates for the open period

> Auto-detected ops plus override-linked / fabricated rows. Query: page, pageSize, search, inclusion (all|included|excluded|none), detected (all|valid|invalid).



## OpenAPI

````yaml /docs/openapi.json get /api/mesas/{id}/candidates
openapi: 3.0.0
info:
  title: FinSync API Documentation
  version: 1.0.0
  description: API documentation for FinSync application
  contact:
    name: FinSync Support
    email: support@finsync.com
servers:
  - url: https://api.finsync.ar
    description: Direct Fly API (preferred for API keys and webhooks)
  - url: https://finsync.ar
    description: Same-origin via finsync.ar (Vercel rewrite)
security:
  - apiKey: []
tags:
  - name: Clients
    description: Operations related to clients and their accounts
  - name: Tags
    description: >-
      Company-scoped client labels (Configuración > Etiquetas). Distinct from
      the special Centro de resultados / Centro de costos tag used for budget
      clients.
  - name: Accounts
    description: Operations related to account balances
  - name: Cost Centers
    description: Company centros de resultados (cost_center_id) and their budgets
  - name: Operations
    description: Operations for creating and managing financial operations
  - name: Operation Types
    description: Company operation types management
  - name: Transaction Types
    description: Company transaction types management
  - name: WhatsApp Tools
    description: >-
      Company-scoped WhatsApp bot operation tools (Configuración > WhatsApp >
      Tools). Same WhatsAppOperationTool rows as the dashboard. Authenticate
      with x-api-key.
  - name: External client
    description: >-
      Exports for external (portal-linked) clients. Authenticate with
      `x-api-key` (company-owned client ID) or `Authorization: Bearer` (Auth.js
      session for an ExternalAccessGrant).
  - name: Mesas
    description: >-
      Company FX trading desks (mesas). Same records and paths as the dashboard
      Mesas module. Integrators authenticate with x-api-key; the dashboard uses
      an employee session. Superadmin must set mesas_enabled first; there is no
      public PATCH for that flag. created_by / opened_by / closed_by are null
      for API-key callers.
  - name: Home metrics
    description: >-
      Named dashboard home metrics (list + values). API keys receive the
      Métricas-group cards (day P&L, commissions, cost centers) without the
      metrics-password cookie. Employee sessions need the matching view
      permission; they still skip the UI password gate on this surface.
paths:
  /api/mesas/{id}/candidates:
    get:
      tags:
        - Mesas
      summary: List mesa candidates for the open period
      description: >-
        Auto-detected ops plus override-linked / fabricated rows. Query: page,
        pageSize, search, inclusion (all|included|excluded|none), detected
        (all|valid|invalid).
      parameters:
        - in: path
          name: id
          required: true
          schema:
            type: integer
          description: Mesa ID
        - in: query
          name: page
          schema:
            type: integer
            default: 1
        - in: query
          name: pageSize
          schema:
            type: integer
            default: 25
        - in: query
          name: search
          schema:
            type: string
        - in: query
          name: inclusion
          schema:
            type: string
            enum:
              - all
              - included
              - excluded
              - none
            default: all
        - in: query
          name: detected
          schema:
            type: string
            enum:
              - all
              - valid
              - invalid
            default: all
      responses:
        '200':
          description: Candidates page
          content:
            application/json:
              schema:
                type: object
              example:
                mesa:
                  id: 1
                  company_id: 42
                  name: ARS/USD desk
                  local_currency: ARS
                  quote_currency: USD
                  costing_method: fifo
                  account_ids:
                    - 10
                    - 11
                  created_by: null
                  created_at: '2026-03-01T00:00:00.000Z'
                  updated_at: '2026-03-01T00:00:00.000Z'
                  deleted_at: null
                period:
                  id: 5
                  mesa_id: 1
                  status: open
                  opened_at: '2026-03-01T00:00:00.000Z'
                  closed_at: null
                  opening_local: 1000000
                  opening_fx: 1200
                  closing_local: null
                  closing_avg_fx: null
                  pnl_local: null
                  pnl_quote: null
                  closing_report: null
                  opened_by: null
                  closed_by: null
                  created_at: '2026-03-01T00:00:00.000Z'
                  updated_at: '2026-03-01T00:00:00.000Z'
                candidates:
                  - operationId: 88
                    overrideId: null
                    date: '2026-03-02T12:00:00.000Z'
                    description: FX buy
                    detected:
                      side: buy
                      localAmount: 125000
                      quoteAmount: 100
                      fx: 1250
                    included: true
                pagination:
                  page: 1
                  pageSize: 25
                  total: 1
                  totalPages: 1
        '400':
          description: Invalid mesa ID
        '401':
          description: Unauthorized - Missing or invalid API key
        '403':
          description: >-
            Mesas module not enabled for this company (superadmin must set
            mesas_enabled). No public PATCH for that flag.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MesasDisabledError'
              example:
                error: Mesas module not enabled for this company
                code: MESAS_DISABLED
        '404':
          description: Mesa not found
        '409':
          description: No open period
        '500':
          description: Server error
      security:
        - apiKey: []
components:
  schemas:
    MesasDisabledError:
      type: object
      properties:
        error:
          type: string
          example: Mesas module not enabled for this company
        code:
          type: string
          example: MESAS_DISABLED
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: x-api-key
      description: API Key for authentication

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.