Docs · SDKs
REST
Call the API over plain HTTP: authentication, every endpoint with a curl sample, and how to verify a record without a client library.
Install
REST
Any HTTP client.
Nothing to install. Base URL https://api.invoance.com; one header carries the key.
Terminal
# Nothing to install. Keep the key in the environment.
export INVOANCE_API_KEY="invoance_live_..."
Client
| Base URL | https://api.invoance.com; product routes sit under /v1, GET /keys/{domain} at the root. |
|---|---|
| Authorization | Bearer followed by the key; read before X-API-Key when both are sent. |
| X-API-Key | The raw key; used only when no Authorization header is present. |
| Idempotency-Key | Optional on POST /v1/events, /v1/document/anchor and /v1/ai/attestations; required on POST /v1/audit/events. Kept 24 hours. |
| Timeouts and retries | Yours to set. A replay with the same Idempotency-Key and body returns the stored response. |
REST
# Authorization: Bearer is read first; X-API-Key works when it is absent.
curl https://api.invoance.com/v1/me \
-H "Authorization: Bearer $INVOANCE_API_KEY"
# Writes take JSON and an optional Idempotency-Key.
curl -X POST https://api.invoance.com/v1/events \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: policy-approval-pol_8472" \
-d '{"event_type":"policy.approval","payload":{"policy_id":"pol_8472","decision":"approved"}}'
Methods
Every endpoint with a REST sample, by resource. Open a row for the sample; the link opens the endpoint card with its fields, response and errors.
EventsReference
POST/v1/events
REST
curl -X POST https://api.invoance.com/v1/events \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: policy-approval-pol_8472" \
-d '{
"event_type": "policy.approval",
"event_time": "2026-09-22T08:14:07Z",
"payload": {
"policy_id": "pol_8472",
"approved_by": "risk_committee",
"decision": "approved"
}
}'
GET/v1/events
REST
curl "https://api.invoance.com/v1/events?page=1&limit=50&event_type=policy.approval" \
-H "Authorization: Bearer $INVOANCE_API_KEY"
GET/v1/events/{event_id}
REST
curl https://api.invoance.com/v1/events/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4 \
-H "Authorization: Bearer $INVOANCE_API_KEY"
POST/v1/events/{event_id}/verify
REST
curl -X POST https://api.invoance.com/v1/events/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4/verify \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"payload": {
"policy_id": "pol_8472",
"approved_by": "risk_committee",
"decision": "approved"
}
}'
DocumentsReference
POST/v1/document/anchor
REST
HASH=$(shasum -a 256 ./INV-2026-0917.pdf | cut -d ' ' -f 1)
curl -X POST https://api.invoance.com/v1/document/anchor \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: anchor-$HASH" \
-d '{
"document_hash": "'"$HASH"'",
"document_ref": "INV-2026-0917.pdf",
"event_type": "invoice.issued",
"metadata": {
"invoice_number": "INV-2026-0917",
"amount": 5230,
"currency": "USD"
}
}'
GET/v1/document
REST
curl "https://api.invoance.com/v1/document?limit=25&date_from=2026-09-01T00:00:00Z" \
-H "Authorization: Bearer $INVOANCE_API_KEY"
GET/v1/document/{event_id}
REST
curl https://api.invoance.com/v1/document/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4 \
-H "Authorization: Bearer $INVOANCE_API_KEY"
GET/v1/document/{event_id}/original
REST
curl https://api.invoance.com/v1/document/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4/original \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-o ./INV-2026-0917.pdf
POST/v1/document/{event_id}/verify
REST
HASH=$(shasum -a 256 ./INV-2026-0917.pdf | cut -d ' ' -f 1)
curl -X POST https://api.invoance.com/v1/document/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4/verify \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "document_hash": "'"$HASH"'" }'
AI AttestationsReference
POST/v1/ai/attestations
REST
curl -X POST https://api.invoance.com/v1/ai/attestations \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: $(uuidgen)" \
-d '{
"type": "output",
"payload": {
"input": "Summarize the termination clause in contract CT-8472.",
"output": "Either party may terminate with 30 days written notice. Early termination fees do not apply after month 12."
},
"context": {
"model_provider": "openai",
"model_name": "gpt-4.1",
"model_version": "2026-04-14"
},
"subject": {
"user_id": "u_4821",
"session_id": "sess_9f3a",
"department": "legal"
}
}'
GET/v1/ai/attestations
REST
curl "https://api.invoance.com/v1/ai/attestations?limit=50&attestation_type=output&model_provider=openai" \
-H "Authorization: Bearer $INVOANCE_API_KEY"
GET/v1/ai/attestations/{attestation_id}
REST
curl https://api.invoance.com/v1/ai/attestations/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4 \
-H "Authorization: Bearer $INVOANCE_API_KEY"
GET/v1/ai/attestations/{attestation_id}/raw
REST
curl https://api.invoance.com/v1/ai/attestations/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4/raw \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-o attestation-raw.json
# The SHA-256 of the exact bytes is the attestation_hash.
shasum -a 256 attestation-raw.json
POST/v1/ai/attestations/{attestation_id}/verify
REST
curl -X POST https://api.invoance.com/v1/ai/attestations/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4/verify \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"content_hash": "c4efe15781214a84046ad7e0592977c634a5cf45f4c1e06160daf760a295a8df"
}'
TracesReference
POST/v1/traces
REST
curl -X POST https://api.invoance.com/v1/traces \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"label": "Invoice batch 2026-09",
"metadata": { "batch_id": "b_4471", "region": "eu-west" }
}'
GET/v1/traces
REST
curl "https://api.invoance.com/v1/traces?status=open&page=1&limit=25" \
-H "Authorization: Bearer $INVOANCE_API_KEY"
GET/v1/traces/{trace_id}
REST
curl "https://api.invoance.com/v1/traces/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4?event_page=1&event_limit=50" \
-H "Authorization: Bearer $INVOANCE_API_KEY"
DELETE/v1/traces/{trace_id}
REST
curl -X DELETE https://api.invoance.com/v1/traces/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4 \
-H "Authorization: Bearer $INVOANCE_API_KEY"
POST/v1/traces/{trace_id}/seal
REST
curl -X POST https://api.invoance.com/v1/traces/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4/seal \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json"
GET/v1/traces/{trace_id}/proof
REST
curl https://api.invoance.com/v1/traces/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4/proof \
-H "Authorization: Bearer $INVOANCE_API_KEY"
GET/v1/traces/{trace_id}/proof/pdf
REST
curl https://api.invoance.com/v1/traces/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4/proof/pdf \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-o trace-proof.pdf
GET/v1/proof/trace/{trace_id}
REST
curl https://api.invoance.com/v1/proof/trace/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4
Audit LogsReference
POST/v1/audit/events
REST
curl -X POST https://api.invoance.com/v1/audit/events \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: signin-u_4821-2026-09-22T08:14:07Z" \
-d '{
"organization_id": "org_8472",
"action": "user.signed_in",
"occurred_at": "2026-09-22T08:14:07Z",
"actor": { "type": "user", "id": "u_4821", "name": "Ada Lovelace" },
"targets": [{ "type": "workspace", "id": "ws_17" }],
"context": { "location": "203.0.113.10", "user_agent": "Mozilla/5.0" },
"metadata": { "method": "sso", "mfa": true }
}'
GET/v1/audit/events
REST
curl "https://api.invoance.com/v1/audit/events?organization_id=org_8472&actions=user.signed_in,user.signed_out&limit=50" \
-H "Authorization: Bearer $INVOANCE_API_KEY"
GET/v1/audit/events/{id}
REST
curl https://api.invoance.com/v1/audit/events/aevt_01J0Y1Z2A3B4C5D6E7F8G9H0JK \
-H "Authorization: Bearer $INVOANCE_API_KEY"
GET/v1/audit/events/{id}/verify
REST
curl https://api.invoance.com/v1/audit/events/aevt_01J0Y1Z2A3B4C5D6E7F8G9H0JK/verify \
-H "Authorization: Bearer $INVOANCE_API_KEY"
POST/v1/audit/orgs
REST
curl -X POST https://api.invoance.com/v1/audit/orgs \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"organization_id": "org_8472",
"name": "Acme Robotics"
}'
GET/v1/audit/orgs
REST
curl "https://api.invoance.com/v1/audit/orgs?include_archived=true" \
-H "Authorization: Bearer $INVOANCE_API_KEY"
PATCH/v1/audit/orgs/{id}
REST
curl -X PATCH https://api.invoance.com/v1/audit/orgs/org_8472 \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "name": "Acme Robotics Ltd" }'
DELETE/v1/audit/orgs/{id}
REST
curl -X DELETE https://api.invoance.com/v1/audit/orgs/org_8472 \
-H "Authorization: Bearer $INVOANCE_API_KEY"
POST/v1/audit/orgs/{id}/archive
REST
curl -X POST https://api.invoance.com/v1/audit/orgs/org_8472/archive \
-H "Authorization: Bearer $INVOANCE_API_KEY"
POST/v1/audit/orgs/{id}/unarchive
REST
curl -X POST https://api.invoance.com/v1/audit/orgs/org_8472/unarchive \
-H "Authorization: Bearer $INVOANCE_API_KEY"
GET/v1/audit/orgs/{id}/integrity
REST
curl "https://api.invoance.com/v1/audit/orgs/org_8472/integrity?from=1&to=1000" \
-H "Authorization: Bearer $INVOANCE_API_KEY"
PUT/v1/audit/orgs/{id}/retention
REST
curl -X PUT https://api.invoance.com/v1/audit/orgs/org_8472/retention \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "days": 365 }'
POST/v1/audit/orgs/{id}/streams
REST
curl -X POST https://api.invoance.com/v1/audit/orgs/org_8472/streams \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"type": "webhook",
"url": "https://siem.example.com/hooks/invoance"
}'
GET/v1/audit/orgs/{id}/streams
REST
curl https://api.invoance.com/v1/audit/orgs/org_8472/streams \
-H "Authorization: Bearer $INVOANCE_API_KEY"
DELETE/v1/audit/orgs/{id}/streams/{stream_id}
REST
curl -X DELETE https://api.invoance.com/v1/audit/orgs/org_8472/streams/astr_01J0Y3N5P7R9T1V3X5Z7B9D1FG \
-H "Authorization: Bearer $INVOANCE_API_KEY"
POST/v1/audit/orgs/{id}/streams/{stream_id}/test
REST
curl -X POST https://api.invoance.com/v1/audit/orgs/org_8472/streams/astr_01J0Y3N5P7R9T1V3X5Z7B9D1FG/test \
-H "Authorization: Bearer $INVOANCE_API_KEY"
POST/v1/audit/portal_sessions
REST
curl -X POST https://api.invoance.com/v1/audit/portal_sessions \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"organization_id": "org_8472",
"intent": "audit_logs",
"session_duration_seconds": 3600
}'
POST/v1/audit/exports
REST
curl -X POST https://api.invoance.com/v1/audit/exports \
-H "Authorization: Bearer $INVOANCE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"organization_id": "org_8472",
"format": "ndjson",
"filters": {
"actions": "user.signed_in,user.signed_out",
"occurred_after": "2026-09-01T00:00:00Z"
}
}'
GET/v1/audit/exports/{id}
REST
curl https://api.invoance.com/v1/audit/exports/aexp_01J0Y4Q6S8V0X2Z4B6D8F0H2JK \
-H "Authorization: Bearer $INVOANCE_API_KEY"
POST/v1/audit/portal/exchange
REST
curl -X POST https://api.invoance.com/v1/audit/portal/exchange \
-H "Content-Type: application/json" \
-d '{ "token": "pl_3f8a9c1d2e4b5a6f7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b" }'
GET/v1/audit/portal/events
REST
curl "https://api.invoance.com/v1/audit/portal/events?actions=user.signed_in&limit=50" \
-H "Authorization: Bearer $PORTAL_TOKEN"
GET/v1/audit/portal/events/{id}
REST
curl https://api.invoance.com/v1/audit/portal/events/aevt_01J0Y1Z2A3B4C5D6E7F8G9H0JK \
-H "Authorization: Bearer $PORTAL_TOKEN"
GET/v1/audit/portal/events/{id}/verify
REST
curl https://api.invoance.com/v1/audit/portal/events/aevt_01J0Y1Z2A3B4C5D6E7F8G9H0JK/verify \
-H "Authorization: Bearer $PORTAL_TOKEN"
GET/v1/audit/portal/org
REST
curl https://api.invoance.com/v1/audit/portal/org \
-H "Authorization: Bearer $PORTAL_TOKEN"
GET/v1/audit/portal/streams
REST
curl https://api.invoance.com/v1/audit/portal/streams \
-H "Authorization: Bearer $PORTAL_TOKEN"
POST/v1/audit/portal/streams
REST
curl -X POST https://api.invoance.com/v1/audit/portal/streams \
-H "Authorization: Bearer $PORTAL_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"type": "webhook",
"url": "https://siem.example.com/hooks/invoance"
}'
DELETE/v1/audit/portal/streams/{id}
REST
curl -X DELETE https://api.invoance.com/v1/audit/portal/streams/astr_01J0Y3N5P7R9T1V3X5Z7B9D1FG \
-H "Authorization: Bearer $PORTAL_TOKEN"
POST/v1/audit/portal/streams/{id}/test
REST
curl -X POST https://api.invoance.com/v1/audit/portal/streams/astr_01J0Y3N5P7R9T1V3X5Z7B9D1FG/test \
-H "Authorization: Bearer $PORTAL_TOKEN"
GET/v1/proof/audit/{event_id}
REST
curl https://api.invoance.com/v1/proof/audit/aevt_01J0Y1Z2A3B4C5D6E7F8G9H0JK
POST/v1/proof/audit/{event_id}/verify
REST
curl -X POST https://api.invoance.com/v1/proof/audit/aevt_01J0Y1Z2A3B4C5D6E7F8G9H0JK/verify \
-H "Content-Type: application/json" \
-d @event.json
PlatformReference
GET/v1/me
REST
curl https://api.invoance.com/v1/me \
-H "Authorization: Bearer $INVOANCE_API_KEY"
GET/keys/{domain}
REST
curl https://api.invoance.com/keys/acme.com
GET/v1/proof/event/{event_id}
REST
curl https://api.invoance.com/v1/proof/event/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4
POST/v1/proof/event/{event_id}/verify
REST
curl -X POST https://api.invoance.com/v1/proof/event/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4/verify \
-H "Content-Type: application/json" \
-d '{
"payload": {
"policy_id": "pol_8472",
"approved_by": "risk_committee",
"decision": "approved"
}
}'
GET/v1/proof/{event_id}/organization
REST
curl https://api.invoance.com/v1/proof/3f9d2a71-5c6e-4b8a-9d1f-8e2c47b0a5d3/organization
POST/v1/proof/{event_id}/verify
REST
curl -X POST https://api.invoance.com/v1/proof/3f9d2a71-5c6e-4b8a-9d1f-8e2c47b0a5d3/verify \
-H "Content-Type: application/json" \
-d '{
"document_hash": "dd9c25fbcc4061970195f861142de4ad492bd7741f66f73cb0b1f186c676904d"
}'
GET/v1/proof/ai/{attestation_id}
REST
curl https://api.invoance.com/v1/proof/ai/a1d4f8c2-7b3e-4e9a-b5c6-0d2e8f4a7c19
POST/v1/proof/ai/{attestation_id}/verify
REST
curl -X POST https://api.invoance.com/v1/proof/ai/a1d4f8c2-7b3e-4e9a-b5c6-0d2e8f4a7c19/verify \
-H "Content-Type: application/json" \
-d '{
"content_hash": "a11ffee6d6ba93b478f557318a2b1a823f6e2816e0bd5d8178cc889a30e40fe5"
}'
Verify offlineHow verification works
No SDK is involved. Fetch the record's signed bytes, signature and key from a public proof endpoint, fetch the organization's key from GET /keys/{domain}, and run an Ed25519 verify with any library. The Node.js and Python samples on that endpoint's card show the full check.
REST
# The organization's key, by its verified domain. No API key needed.
curl https://api.invoance.com/keys/acme.com
# The public part of a signed event: hashes, public_key, signature and
# signed_payload (hex). Verify signature over the decoded signed_payload.
curl https://api.invoance.com/v1/proof/event/7c1e4b52-9a0f-4d2e-b6f3-2f8a61c0d9e4