Errors

All API errors use this shape:

{
  "error": {
    "code": "INVALID_SIGNATURE",
    "message": "The request signature is invalid."
  }
}

Common authentication and request codes include INVALID_CREDENTIALS, CREDENTIAL_EXPIRED, INVALID_SIGNATURE, NONCE_REPLAYED, IDEMPOTENCY_CONFLICT, and IDEMPOTENCY_IN_PROGRESS. Operation and workflow codes include OPERATION_NOT_FOUND, INVALID_STATUS_TRANSITION, MANUAL_REVIEW_ALREADY_DECIDED, PROCESSING_TRACE_SCOPE_MISMATCH, WORKFLOW_RUNTIME_ATTESTATION_FAILED, POLICY_NOT_CONFIGURED, PARTNER_POLICY_NOT_CONFIGURED (legacy alias DOCUMENT_REQUIREMENT_POLICY_NOT_CONFIGURED), SCHEMA_VALIDATION_FAILED, and DOCUMENT_ANALYSIS_FAILED. A workflow or source failure never becomes a successful result. Upload security codes include UNSUPPORTED_FILE_TYPE, INVALID_FILE_SIZE, FILE_EXTENSION_MISMATCH, UNPARSEABLE_FILE, FILE_SIGNATURE_MISMATCH, STORED_CONTENT_TYPE_MISMATCH, FILE_HASH_MISMATCH, DUPLICATE_DOCUMENT_HASH, MALWARE_DETECTED, MALWARE_SCAN_INDETERMINATE, and MALWARE_SCANNER_UNAVAILABLE. Scanner unavailability is fail-closed. Webhook URL validation can return INVALID_WEBHOOK_URL; HTTPS targets resolving to localhost, private, link-local, or other blocked addresses are rejected.

Integration

Trust and release

Authentication