COSHH Substances¶

Status: Specified — ready to build Build order: 13 of 13 — depends on Projects & Sites

Purpose¶

COSHH Substances is the site-level register of hazardous substances in use under the Control of Substances Hazardous to Health Regulations 2002. For each substance brought onto site, the register records what it is, the hazard classification, the PPE and control measures required, storage and disposal requirements, and the emergency procedure in case of exposure.

The register serves two purposes: compliance evidence that a COSHH assessment has been carried out before the substance was used, and the reference source for COSHH briefings delivered via the Briefings module.

Entities¶

COSHHSubstance¶

One record per hazardous substance in use on a site.

CREATE INDEX idx_coshh_site
    ON coshh_substances(site_id) WHERE deleted_at IS NULL;
CREATE INDEX idx_coshh_project
    ON coshh_substances(project_id) WHERE deleted_at IS NULL;
CREATE INDEX idx_coshh_status
    ON coshh_substances(site_id, status) WHERE deleted_at IS NULL;
CREATE INDEX idx_coshh_risk
    ON coshh_substances(site_id, risk_level) WHERE deleted_at IS NULL;
-- Review scanner
CREATE INDEX idx_coshh_review
    ON coshh_substances(next_review_date) WHERE deleted_at IS NULL AND next_review_date IS NOT NULL;

Hazard classification values (GHS/CLP categories):

Risk level values:

Substance status values:

JSONB Field Structures¶

ppe_required¶

[
  "chemical-resistant gloves",
  "safety goggles",
  "respiratory protection (FFP3 if dust generated)",
  "chemical-resistant overalls"
]

Business Rules¶

1. One record per substance per site. The same product used on two different sites has two records (different site_id). Assessments may vary by site.

2. hazard_classification is a single primary classification. If a substance has multiple hazards (e.g. flammable and toxic), select the highest-risk classification as primary and record the others in description or control_measures.

3. assessment_file_key is optional. Many small-company assessments are recorded directly in the structured fields rather than by uploading a separate document. Both approaches are valid.

4. Transitioning status to removed does not delete the record. It remains visible in the register for the project's retention period.

5. A COSHH briefing for a substance is recorded in the Briefings module with category = coshh_briefing. The Briefings module does not hold a FK to coshh_substances in V1 — the link is by convention (the briefing title or content points reference the substance name).

6. next_review_date triggers an alert when the date is within the tenant's configured advance notice window (same scanner pattern as Documents).

API Endpoints¶

Request / Response Shapes¶

POST /sites/{siteId}/coshh¶

// Request
{
  "product_name": "Sika Primer 3N",
  "manufacturer": "Sika Limited",
  "hazard_classification": "flammable",
  "un_number": "UN1133",
  "description": "Bonding primer applied to concrete surfaces before waterproof membrane",
  "risk_level": "medium",
  "ppe_required": [
    "chemical-resistant gloves",
    "safety goggles",
    "adequate ventilation — avoid confined spaces"
  ],
  "control_measures": "Apply in well-ventilated areas only. No ignition sources within 3m. Maximum container size on site: 5L. Store in locked COSHH cabinet.",
  "storage_requirements": "Locked COSHH cabinet, away from heat sources. Max 50L on site at any time.",
  "disposal_method": "Dispose as hazardous waste. Contact waste carrier — do not pour down drain.",
  "emergency_procedure": "Eye contact: flush with water for 15 minutes, seek medical attention. Skin: wash with soap and water. Inhalation: move to fresh air. Spill: contain with sand/earth, bag and label for hazardous waste collection.",
  "assessed_by": "uuid-user",
  "assessed_date": "2026-05-28",
  "next_review_date": "2027-05-28",
  "custom_fields": {}
}

// Response 201
{
  "id": "uuid-substance",
  "site_id": "uuid-site",
  "project_id": "uuid-project",
  "product_name": "Sika Primer 3N",
  "manufacturer": "Sika Limited",
  "hazard_classification": "flammable",
  "un_number": "UN1133",
  "risk_level": "medium",
  "ppe_required": ["chemical-resistant gloves", "safety goggles", "adequate ventilation — avoid confined spaces"],
  "status": "active",
  "assessed_by": "uuid-user",
  "assessed_by_name": "James Fletcher",
  "assessed_date": "2026-05-28",
  "next_review_date": "2027-05-28",
  "assessment_file_key": null,
  "custom_fields": {},
  "created_at": "2026-05-28T10:00:00Z"
}

GET /sites/{siteId}/coshh¶

Query params: hazard_classification, risk_level, status (active|removed), q (product name / manufacturer search), sort (default product_name), limit, cursor

Permission Matrix¶

Notifications Triggered¶

Scanner query:

SELECT *
FROM coshh_substances
WHERE deleted_at IS NULL
  AND next_review_date IS NOT NULL
  AND next_review_date BETWEEN CURRENT_DATE AND CURRENT_DATE + :advance_days
  AND status = 'active'

Offline Sync Scope¶

The register is read on site to support briefings and emergency response — offline access to the substance list (PPE, emergency procedure) is therefore important. Documents are large and fetched on demand only.

Cross-Module Dependencies¶

Upstream¶

Downstream¶

Tests Required¶

Substances¶

• Register substance — valid payload → 201
• List substances — filter by hazard_classification, risk_level, status
• q search matches product name and manufacturer
• Update substance — PATCH semantics
• Mark as removed — excluded from active list by default
• Soft delete — excluded from list
• Upload assessment — returns presigned PUT URL
• Review scanner — substance with next_review_date in advance window → notification

Cross-tenant isolation (mandatory)¶

• GET substance from another tenant's site → 404
• POST substance with site_id from another tenant → 404

Permission boundaries¶

• Site Manager can register and edit substances → 201
• Site Manager cannot delete substance → 403
• Viewer can view register → 200; cannot register → 403

Default Tenant Labels¶

Foundation Dependencies¶