Documents

Five endpoints for anchoring document hashes into the append-only ledger, listing and retrieving records, downloading originals, and verifying hashes.

POST/document/anchorAnchor a document

Anchors a document hash into the append-only ledger. The server signs a canonical payload using the tenant's private key and returns a verifiable proof. Optionally pass trace_id to attach the document to an open trace. If the same document hash is anchored again, the API returns 409 Conflict with the existing event details.

POST /document/anchor
Authorization: Bearer invoance_live_xxx
Idempotency-Key: <uuid>
Content-Type: application/json

{
  "document_hash": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3…",
  "document_ref":  "Invoice #1042",
  "event_type":    "invoice",
  "metadata":      { "department": "finance" },
  "trace_id":      "9549c332-…"  // optional, attach to a trace
}

GET/documentList documents

Returns a paginated list of document events for the authenticated tenant. Supports filtering by date range and document reference. Maximum 500 results per page, cached for 30 seconds.

GET /document?page=1&limit=50&date_from=2026-01-01&document_ref=Invoice
Authorization: Bearer invoance_live_xxx

GET/document/:event_idRetrieve a document event

Retrieves an immutable ledger record including cryptographic signatures and metadata. Read-only. Requires the read scope.

GET /document/9549c332-a52b-…
Authorization: Bearer invoance_live_xxx

GET/document/:event_id/originalDownload original document

Returns the original document file as raw bytes. Only available if the document was anchored with original_bytes_b64. Response is application/octet-stream. Cached server-side for 5 minutes.

GET /document/9549c332-a52b-…/original
Authorization: Bearer invoance_live_xxx
Accept: application/octet-stream

POST/document/:event_id/verifyVerify document hash

Compares a submitted SHA-256 hash against the anchored document hash. Returns whether the hash matches. No authentication is required for public proof verification, but this API-scoped endpoint requires a valid key.

POST /document/9549c332-a52b-…/verify
Authorization: Bearer invoance_live_xxx
Content-Type: application/json

{
  "document_hash": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3…"
}

POST /document/anchor Authorization: Bearer invoance_live_xxx Idempotency-Key: <uuid> Content-Type: application/json { "document_hash": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3…", "document_ref": "Invoice #1042", "event_type": "invoice", "metadata": { "department": "finance" }, "trace_id": "9549c332-…" // optional, attach to a trace }