API conventions

The Dockt API uses consistent HTTP, JSON, and resource conventions across /v1.

Base URL

Send production requests to https://api.dockt.com. Product routes begin with /v1.

The API accepts and returns JSON for structured requests. Document uploads use multipart/form-data. Error responses use application/problem+json.

Choose the relevant API area

A backend verification integration normally uses:

• Auth to inspect its authenticated Workspace and permissions.
• Features and CompliancePackages to read Workspace configuration.
• Documents, Assessments, and Decisions for verification workflows.
• Webhooks for asynchronous completion events.

The API reference also includes browser-session, Account, Workspace, account-user, and API-credential administration. You don’t need those operations when your backend already has a workspace credential. Plan your backend integration provides a workflow-oriented endpoint map.

Authentication

Send an API key or M2M access token with every protected request:

Authorization: Bearer YOUR_TOKEN

Authenticate your backend

Response envelopes

A single resource uses an object: "single" envelope:

{
  "object": "single",
  "data": {
    "object": "document",
    "id": "doc_example"
  }
}

A collection uses an object: "list" envelope:

{
  "object": "list",
  "data": [],
  "has_more": false,
  "next_cursor": null
}

Deletion operations return a single envelope whose resource includes deleted: true.

Resource identifiers

Dockt IDs are opaque strings with a resource prefix. Common prefixes include:

• acc_ for Accounts.
• wsp_ for Workspaces.
• feat_ for Features.
• ast_ for Assessments.
• doc_ for Documents.
• dec_ for Decisions.
• cred_ for API credentials.
• whk_ for webhook endpoints.
• evt_ for webhook events.

Treat IDs as case-sensitive opaque values. Don’t derive authorization or business state from a prefix.

Dates and times

Date-time fields use ISO 8601 strings with a time-zone offset, such as 2026-08-06T09:30:00Z.

Calendar-date fields use YYYY-MM-DD, such as 1990-05-17. Don’t apply a time zone to calendar dates.

Request correlation

Dockt returns these headers:

• x-request-id: the request identifier to include in logs and support requests.
• traceparent: distributed trace context you can propagate according to your tracing setup.

Dockt accepts an incoming traceparent header. Never place personal data or secrets in tracing attributes.

Status codes

Common successful responses are:

• 200 OK for reads, updates, deletions, and accepted invitation resends.
• 201 Created when a resource or Outcome is created synchronously.
• 202 Accepted when asynchronous Document processing or webhook test delivery is accepted.

Common error responses are:

• 400 Bad Request for malformed input or an invalid cursor.
• 401 Unauthorized for missing or invalid authentication.
• 403 Forbidden for an incompatible scope or missing permission.
• 404 Not Found when the resource isn’t available in the authenticated scope.
• 409 Conflict for state or idempotency conflicts.
• 422 Unprocessable Content for structured validation or invalid references.
• 429 Too Many Requests when a rate limit is exceeded.
• 500 Internal Server Error for an unexpected Dockt failure.

Handle errors

OpenAPI contract

Use OpenAPI JSON for exact operation, parameter, request, response, enum, and permission definitions. The interactive API reference is generated from the same document.

Review API compatibility and updates before replacing generated client types.