Essence Vault API

Version v1.0 · OpenAPI 3.0.1 · 264 operations · Download the JSON document

REST API for managing zero-knowledge encrypted personal data vaults and documents. ## Architecture - **Zero-Knowledge Encryption**: All sensitive data encrypted client-side - **Schema-Based Documents**: Flexible JSON Schema validation - **Full-Text Search**: Elasticsearch-powered search (on encrypted metadata) - **Chunked Uploads**: Large file support with resumable uploads All endpoints require a Bearer token issued by the Essence Auth service (WS-C 4.3 foundation adoption).

Generated from the Vault service's code at build time (api-specs/generated/Vault/Essence.Core.Vault.Api.json) and drift-checked in CI. It describes what the code registers, which is not the same as what any one deployment has routed.

Access Reconstruction

GET/api/v1/vault/access-reconstruction

Reconstruct windowed decrypt-access

Returns the per-document/field serve events recorded under the caller's account within [startedAt, endedAt]. Metadata only (zero-knowledge). Never fabricates events.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`startedAt`	query	`string (date-time)`	no	Window start (inclusive), UTC.
`endedAt`	query	`string (date-time)`	no	Window end (inclusive), UTC.

Request body

No request body.

Responses

200Reconstruction retrieved successfully. — AccessReconstructionDto

400The reconstruction window is invalid. — ProblemDetails

401The caller is not authenticated. — ProblemDetails

AccountMerge

GET/api/v1/account/merge/{mergeId}/conflicts

Get the bulk merge-conflict queue

Scans both accounts' vaults, auto-resolves the non-critical collisions server-side, and returns only the critical collisions to triage plus the auto-resolved + unreadable counts. Metadata only.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`mergeId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The bulk conflict queue (critical set + auto-resolved / unreadable counts). — MergeConflictQueueDto

403The caller does not own the merge. — ProblemDetails

404The merge does not exist. — ProblemDetails

POST/api/v1/account/merge/{mergeId}/resolutions

Accept the merge-conflict resolution set

Records the caller's triage choice for each named conflict ahead of the merge commit. Commits nothing to the vaults.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`mergeId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

AcceptMergeResolutionsRequestDto as application/*+json, application/json, text/json

Responses

200The refreshed bulk conflict queue. — MergeConflictQueueDto

400Invalid resolution payload. — ProblemDetails

403The caller does not own the merge. — ProblemDetails

404The merge does not exist. — ProblemDetails

409A resolution targets a non-conflict item or an already-applied merge. — ProblemDetails

GET/api/v1/account/merge/{mergeId}/summary

Get the authoritative merge-preview summary

Returns the one figure set — keyed to the chosen survivor — that the account-merge journey renders identically at the step-2 preview, step-5 consent, step-6 warning and step-7 receipt. Documents are authoritative from the vault reconciliation; contacts and consents are honest-unavailable until their owning capabilities supply them. Metadata only.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`mergeId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The merge-preview summary (documents authoritative; contacts/consents when supplied). Metadata only. — MergeSummaryDto

403The caller does not own the merge. — ProblemDetails

404The merge does not exist. — ProblemDetails

AdministrativeVaultAccess

POST/api/v1/administration/vault-access/{subjectUserId}

Applies the vault-access effect of an administrative account-state change to one subject: locks access for a restricting operation class, restores it for a reinstating one.

Idempotent. Re-applying a lock that is already in force, and lifting one that is not, are both successful — the caller resumes by re-driving outstanding subjects — and are distinguished from a first application by `stateChanged` in the response.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`subjectUserId`	path	`string (uuid)`	yes	The subject whose vault access moves.

Request body

Not marked as required in the document.

AdministrativeVaultAccessEffectRequestDto as application/*+json, application/json, text/json

Responses

200OK — AdministrativeVaultAccessEffectDto

400Bad Request — ProblemDetails

401Unauthorized — ProblemDetails

403Forbidden — ProblemDetails

AttorneyScope

POST/api/v1/attorney-scope

Provision an attorney scope

The vault owner (donor) grants an attorney a time-boxed field/document/category-scoped read authority.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

ProvisionAttorneyScopeRequestDto as application/*+json, application/json, text/json

Responses

201The provisioned scope grant. — AttorneyVaultScopeGrantDto

400The request failed validation (e.g. empty scope, past expiry, donor == attorney). — ProblemDetails

403The caller does not own the target vault. — ProblemDetails

404The target vault was not found. — ProblemDetails

GET/api/v1/attorney-scope/grants

List my active attorney scope grants

Returns the caller-attorney's active (non-revoked, non-expired) vault scope grants so the workspace can link each donor to their vault landing.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200The caller-attorney's active scope grants (possibly empty), newest first. — AttorneyScopeGrantSummaryDto[]

POST/api/v1/attorney-scope/revoke

Revoke an attorney scope

The donor withdraws a previously-granted attorney scope before its expiry.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

RevokeAttorneyScopeRequestDto as application/*+json, application/json, text/json

Responses

200The revoked scope grant. — AttorneyVaultScopeGrantDto

404The grant was not found (or the caller is not its donor). — ProblemDetails

409The grant is already revoked. — ProblemDetails

GET/api/v1/attorney-scope/{vaultId}/audit

Attorney-action audit trail

Every attorney scoped read against the vault — served or withheld — newest first.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The attorney-action audit trail (possibly empty), newest first. — AttorneyReadAuditEntryDto[]

403The caller does not own the vault. — ProblemDetails

404The vault was not found. — ProblemDetails

GET/api/v1/attorney-scope/{vaultId}/documents/{documentId}

Read a document under attorney scope

Gates the read on the PoA scope; out-of-scope reads are provably withheld and logged.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	—
`documentId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The in-scope document with its authorising allocation. — AttorneyScopedDocumentDto

403The document is outside the PoA scope (the attempt is logged). — ProblemDetails

404No active scope grants the attorney access to this vault. — ProblemDetails

GET/api/v1/attorney-scope/{vaultId}/landing

Attorney first-access landing

Resolves the attorney's active scope over a vault into the before-any-data landing surface.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The first-access landing (whose vault / authority / scope / actions / audit notice). — AttorneyFirstAccessLandingDto

404No active scope grants the attorney access to this vault. — ProblemDetails

Name	In	Type	Required	Description
`vaultId`	query	`string (uuid)`	no	Vault ID to filter categories (required).
`parentCategoryId`	query	`string (uuid)`	no	Optional parent category ID to filter child categories (null for root categories).
`includeDeleted`	query	`boolean`	no	Include soft-deleted categories in results (default: false).
`pageNumber`	query	`integer (int32)`	no	The page number (default: 1).
`pageSize`	query	`integer (int32)`	no	The page size (default: 10, max: 100).

Name	In	Type	Required	Description
`vaultId`	query	`string (uuid)`	no	The vault ID.

Name	In	Type	Required	Description
`vaultId`	query	`string (uuid)`	no	The vault ID.
`fileName`	query	`string`	no	The document file name.
`contentType`	query	`string`	no	The document MIME content type.
`schemaId`	query	`string (uuid)`	no	Optional schema ID for schema-aware suggestions.

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The category ID.
`includeDeleted`	query	`boolean`	no	Include soft-deleted category (default: false).

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The category ID.

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The category ID.

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The root category ID.
`includeDeleted`	query	`boolean`	no	Include soft-deleted categories (default: false).

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The category ID.

Child Shared Records Space

GET/api/v1/vaults/children/{childId}/shared-space

Get a child's co-custodianship shared-records space

Returns the co-custodian roster (both parents) with their capabilities. Custodian-only access.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`childId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The shared-records space. — ChildSharedRecordsSpaceDto

401Caller is not authenticated. — ProblemDetails

403Caller is not a custodian of this child. — ProblemDetails

404No shared-records space exists for this child yet. — ProblemDetails

Contact Handover

GET/api/v1/vaults/erasure-attestations/{linkId}

Get a contact erasure attestation

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`linkId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The erasure attestation. — ContactErasureAttestationDto

401Caller is not authenticated. — ProblemDetails

404The contact has not been erased. — ProblemDetails

POST/api/v1/vaults/handover/contacts

Hand over a contact on account closure

Records a keep-a-copy retention or a purge into the Trash / Recently-Deleted store. Zero-knowledge — a content digest only, never plaintext.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

HandOverContactRequestDto as application/*+json, application/json, text/json

Responses

201Handover recorded. — ContactHandoverRecordDto

400Invalid request. — ProblemDetails

401Caller is not authenticated. — ProblemDetails

GET/api/v1/vaults/trash/contacts

List recoverable trashed contacts

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`closure`	query	`string (uuid)`	no	—

Request body

No request body.

Responses

200The recoverable trashed contacts. — TrashedContactDto[]

401Caller is not authenticated. — ProblemDetails

POST/api/v1/vaults/trash/contacts/{linkId}/recover

Recover a trashed contact

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`linkId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The contact was recovered. — ContactHandoverRecordDto

401Caller is not authenticated. — ProblemDetails

404No trashed contact with that link for this user. — ProblemDetails

409The recovery window has already lapsed. — ProblemDetails

CourtAuthorityAccess

GET/api/v1/vaults/{vaultId}/court-authority/documents/{documentId}

Read a ward's document under a court order

Gates the read on EPIC 6's court-conferred-authority decision, evaluated per read. An ended, suspended or out-of-scope order is refused by the store, not merely logged.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	—
`documentId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The document's authorising allocation, naming the order it was served under. — CourtAuthorityScopedDocumentDto

401Unauthorized — ProblemDetails

403No court-conferred authority permits the access (every refusal reads alike). — ProblemDetails

503The Consent Service could not be consulted; retry after the advertised interval.

Cross-vault search

POST/api/v1/vaults/search

Search documents across every vault the caller can read

Cross-vault search over unencrypted document metadata. Resolves the caller's readable scope (owned vaults, vault-level grants and per-document consents) server-side and returns ranked hits plus category/access/date/schema/tag/vault facet counts (FR-05.027).

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

CrossVaultSearchRequest as application/*+json, application/json, text/json

Responses

200Search completed successfully. — CrossVaultSearchResponse

400Invalid search parameters. — ProblemDetails

401User is not authenticated. — ProblemDetails

403A facet filter was sent and the caller's plan does not include faceted search, or the caller is under an administrative vault-access lock. — ProblemDetails

503A facet filter was sent and the caller's entitlement could not be checked.

GET/api/v1/vaults/search/scope

List the vaults the caller may search

Returns the ids of every vault the authenticated caller can search: owned vaults, vaults granted to them, and vaults holding a document shared directly with them.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200Searchable vault ids retrieved successfully. — (string (uuid))[]

401User is not authenticated. — ProblemDetails

403The caller is under an administrative vault-access lock. — ProblemDetails

CustodyHandOver

GET/api/v1/organizations/{organizationId}/custodial-vaults/sensitivity-label-downgrades

The sponsor's reviewer queue (EPIC 92 FR-OBP.076, #21163): the records this organisation loaded whose members asked for a lower sensitivity label, waiting for a reviewer here. Oldest request first.

Status only, for every record alike: the record, the member's vault, this sponsor's own item id, both labels and when the member asked. Nothing that says what the record is, so a `sensitive` record's queue entry discloses no more than its label.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The sponsor organisation (must be the caller's).

Request body

No request body.

Responses

200The waiting requests (possibly none); `truncated` when more wait than were returned. — SensitivityLabelDowngradeQueueDto

403The caller does not administer the organisation. — ProblemDetails

POST/api/v1/organizations/{organizationId}/custodial-vaults/sensitivity-label-downgrades/{documentId}/approve

A reviewer of the sponsor approves a member's request to lower the sensitivity label of a record this organisation loaded (EPIC 92 FR-OBP.076, #21163): the lower label applies, and the record keeps who asked and who approved, with the times.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The sponsor organisation (must be the caller's, and must have loaded the record).
`documentId`	path	`string (uuid)`	yes	The record.

Request body

No request body.

Responses

200Approved: the record now carries the lower label. — SensitivityLabelDowngradeDecisionDto

403The caller does not administer the organisation. — ProblemDetails

404No such record, or this organisation did not load it. — ProblemDetails

409Nothing is waiting (`sensitivity-label-downgrade-not-pending`), or the caller is the member who asked (`sensitivity-label-downgrade-self-review`). — ProblemDetails

POST/api/v1/organizations/{organizationId}/custodial-vaults/sensitivity-label-downgrades/{documentId}/reject

A reviewer of the sponsor rejects a member's request to lower the sensitivity label of a record this organisation loaded (EPIC 92 FR-OBP.076, #21163): the record keeps its label, and the request stays on it with the reviewer and the time.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The sponsor organisation (must be the caller's, and must have loaded the record).
`documentId`	path	`string (uuid)`	yes	The record.

Request body

No request body.

Responses

200Rejected: the record keeps its label. — SensitivityLabelDowngradeDecisionDto

403The caller does not administer the organisation. — ProblemDetails

404No such record, or this organisation did not load it. — ProblemDetails

409Nothing is waiting, or the caller is the member who asked. — ProblemDetails

PUT/api/v1/organizations/{organizationId}/custodial-vaults/{vaultId}/custodial-key

The custodian organisation registers its own custodial key for the member's vault: the key every record it loads for that member is sealed to while it holds custody (FR-OBP.088).

Several sponsors may hold custody of one member's vault. Each registers a key that no other sponsor's custody names and that is not the member's own, so no sponsor's custody opens another sponsor's records. Only the key id is kept. A retry with the same key is idempotent.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The custodian organisation (must be the caller's).
`vaultId`	path	`string (uuid)`	yes	The member's vault.

Request body

Not marked as required in the document.

RegisterCustodialKeyRequestDto as application/*+json, application/json, text/json

Responses

200Registered, or this exact key was already registered. — CustodialKeyDto

400The body is malformed. — ProblemDetails

403The caller does not administer an organisation. — ProblemDetails

404No such vault, or the organisation is not its custodian. — ProblemDetails

409Custody is no longer held, a different key is registered, or the key is not this sponsor's alone. — ProblemDetails

POST/api/v1/organizations/{organizationId}/custodial-vaults/{vaultId}/custody-destruction

The custodian organisation records that it destroyed its custody of the member's vault, which ends custody. Refused until every record is measured secured to the member's own account.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The custodian organisation (must be the caller's).
`vaultId`	path	`string (uuid)`	yes	The member's vault.

Request body

Not marked as required in the document.

ConfirmCustodyDestructionRequestDto as application/*+json, application/json, text/json

Responses

200Custody ended; or this exact confirmation was already recorded. — CustodyHandedOverDto

400The digest is not 64 hexadecimal characters. — ProblemDetails

403The caller does not administer an organisation. — ProblemDetails

404No such vault, or the organisation is not its custodian. — ProblemDetails

409The member has not taken ownership, a record is not yet secured, or custody already ended with different evidence. — ProblemDetails

PUT/api/v1/organizations/{organizationId}/custodial-vaults/{vaultId}/custody-key-deposits

The custodian organisation delivers one of its custody keys for the member's vault, sealed in its processing zone to the member organisation's own published key.

Accepted only while custody is pending hand-over, only for this custody's custodial or sensitive-role key, and only sealed to the member organisation's currently published key. Essence stores the envelope and cannot open it. A retry with the same envelope changes nothing; a new one replaces it. Withdrawn when custody ends.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The custodian organisation (must be the caller's).
`vaultId`	path	`string (uuid)`	yes	The member's vault.

Request body

Not marked as required in the document.

DepositCustodialKeyRequestDto as application/*+json, application/json, text/json

Responses

200Delivered, or this exact envelope already stood. — CustodialKeyDepositDto

400The body is malformed. — ProblemDetails

403The caller does not administer an organisation. — ProblemDetails

404No such vault, or the organisation is not its custodian. — ProblemDetails

409Custody is not pending hand-over, or the member has not published its own key yet. — ProblemDetails

422The key is not this custody's, the envelope is not sealed to the member's current key, or it is not a well-formed envelope. — ProblemDetails

PUT/api/v1/organizations/{organizationId}/custodial-vaults/{vaultId}/delivered-custodial-key

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The sponsor organisation, as the zone's enrolment names it.
`vaultId`	path	`string (uuid)`	yes	The member's vault.

Request body

Not marked as required in the document.

RegisterCustodialKeyRequestDto as application/*+json, application/json, text/json

Responses

200Registered, or this exact key was already registered. — CustodialKeyDto

400The body is malformed. — ProblemDetails

404No such vault, or the sponsor is not its custodian. — ProblemDetails

409Custody is no longer held, a different key is registered, or the key is not this sponsor's alone. — ProblemDetails

POST/api/v1/organizations/{organizationId}/custodial-vaults/{vaultId}/delivered-records

Deliver one sponsor-sealed record into a member's vault

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The sponsor organisation whose ingestion delivers the record.
`vaultId`	path	`string (uuid)`	yes	The member's vault.

Request body

Not marked as required in the document.

ImportCustodialRecordRequestDto as application/*+json, application/json, text/json

Responses

200This sponsor already delivered the item; nothing stored or charged. — CustodialRecordImportResultDto

201Stored as a new document. — CustodialRecordImportResultDto

400The body is malformed. — ProblemDetails

404No such vault, or the sponsor neither holds custody of it nor has a programme member established into it. — ProblemDetails

409Custody is no longer held, no custodial key is registered yet, the member's objection was purged, the member organisation publishes no key, or the item was delivered into another vault. Once the member has cut over (FR-OBP.078), the problem `type` is `…/problems/sponsor-record-member-migrated`: its legacy record is frozen. — ProblemDetails

422The record is not sealed to the key the sponsor must seal to, or is not a well-formed envelope. — ProblemDetails

POST/api/v1/organizations/{organizationId}/custodial-vaults/{vaultId}/delivered-records/withdrawals

Withdraw one record a sponsor delivered into a member's vault

The sponsor's ingestion calls this when a newer version of a source document it delivered here was placed with a different member: the copy here no longer belongs to this member. It is recorded withdrawn with the reason and archived, never deleted. Only this sponsor's own record for the item, in this vault, is reached.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The sponsor organisation that delivered the record.
`vaultId`	path	`string (uuid)`	yes	The member's vault.

Request body

Not marked as required in the document.

WithdrawSponsorRecordRequestDto as application/*+json, application/json, text/json

Responses

200Withdrawn (now or before), or nothing to withdraw (`withdrawn: false`). — SponsorRecordWithdrawalResultDto

400The body is malformed or the reason is not a known code. — ProblemDetails

409This sponsor delivered the item into another vault. — ProblemDetails

GET/api/v1/organizations/{organizationId}/custodial-vaults/{vaultId}/delivered-sealing-key

The key a sponsor's processing zone must seal to

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The sponsor organisation, as the zone's enrolment names it.
`vaultId`	path	`string (uuid)`	yes	The member's vault.
`sensitivityLabel`	query	`string`	no	The label the record will carry (`sensitive` selects the sensitive-role key under custody).

Request body

No request body.

Responses

200The key id and public key to seal to. — SponsorSealingKeyDto

404No such vault, or the sponsor neither holds custody of it nor has a programme member established into it. — ProblemDetails

409The key is not registered yet, custody is no longer held, the member's objection was purged, the member cut over, or the member organisation publishes no key. — ProblemDetails

POST/api/v1/organizations/{organizationId}/custodial-vaults/{vaultId}/records

The custodian organisation loads one record into the member's custodial vault, sealed to its own registered custodial key, naming the source item it came from (FR-OBP.088). A later sponsor whose programme member was established after the member organisation engaged loads into the organisation's owned vault instead, sealed to the organisation's own published key.

The record is refused unless it is sealed to exactly this sponsor's custodial key: not the member's, not another sponsor's. The document records which sponsor brought it and under which source item. A re-run naming an item this sponsor already loaded stores and charges nothing and answers with the same document. The load is metered to the sponsor (FR-OBP.099). No content or field value is accepted (AGT-006).

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The custodian organisation (must be the caller's).
`vaultId`	path	`string (uuid)`	yes	The member's vault.

Request body

Not marked as required in the document.

ImportCustodialRecordRequestDto as application/*+json, application/json, text/json

Responses

200This sponsor already loaded the item; nothing stored or charged. — CustodialRecordImportResultDto

201Stored as a new document. — CustodialRecordImportResultDto

400The body is malformed. — ProblemDetails

403The caller does not administer an organisation. — ProblemDetails

404No such vault, or the organisation neither holds custody of it nor has a programme member established into it. — ProblemDetails

409Custody is no longer held, no custodial key (or, for a `sensitive` record, no sensitive-role key) is registered yet, the member's objection was purged, the member organisation publishes no key, or the item was loaded into another vault. — ProblemDetails

422The record is not sealed to the key the sponsor must seal to (its custodial key, its sensitive-role key for a `sensitive` record, or the member organisation's published key for an owned vault), or is not a well-formed envelope. — ProblemDetails

GET/api/v1/organizations/{organizationId}/custodial-vaults/{vaultId}/sealing-key

The key the organisation's processing zone must seal its next record for the member's vault to (FR-OBP.088, #21134): its own registered custodial key (its sensitive-role key for a `sensitive` record) while it holds custody, or the member organisation's own published key once a later programme member of this organisation was established into the organisation's owned vault.

Resolved by the same rules `POST …/records` loads by, so a record sealed to the answer is accepted and every refusal here is the one that load would get. The answer has one shape whichever key it is, a key id and a public key, and is only ever derived from this organisation's own custody or membership: never another sponsor's key.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The sponsor organisation (must be the caller's).
`vaultId`	path	`string (uuid)`	yes	The member's vault.
`sensitivityLabel`	query	`string`	no	The label the record will carry (`sensitive` selects the sensitive-role key under custody).

Request body

No request body.

Responses

200The key id and public key to seal to. — SponsorSealingKeyDto

403The caller does not administer an organisation. — ProblemDetails

404No such vault, or the organisation neither holds custody of it nor has a programme member established into it. — ProblemDetails

409The key is not registered yet (`sponsor-custodial-key-not-registered` / `sponsor-sensitive-role-key-not-registered`), custody is no longer held, the member's objection was purged, the member cut over (`member-migrated`), or the member organisation publishes no key. — ProblemDetails

PUT/api/v1/organizations/{organizationId}/custodial-vaults/{vaultId}/sensitive-role-key

The custodian organisation registers its separate sensitive-role key for the member's vault: the key every record labelled `sensitive` it loads for that member is sealed to while it holds custody (FR-OBP.076).

The sensitive-role key is held only by the sponsor's named sensitive-role holders, so a member of sponsor staff who holds the custodial key cannot open a sensitive record, whatever a screen shows. It must differ from this custody's custodial key, from the member's own key and from every key another sponsor's custody names. Only the key id is kept; the key pair and its holders stay in the sponsor's HSM. A retry with the same key is idempotent.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The custodian organisation (must be the caller's).
`vaultId`	path	`string (uuid)`	yes	The member's vault.

Request body

Not marked as required in the document.

RegisterSensitiveRoleKeyRequestDto as application/*+json, application/json, text/json

Responses

200Registered, or this exact key was already registered. — SensitiveRoleKeyDto

400The body is malformed. — ProblemDetails

403The caller does not administer an organisation. — ProblemDetails

404No such vault, or the organisation is not its custodian. — ProblemDetails

409Custody is no longer held, a different sensitive-role key is registered, the key is the custodial key, or it is not this sponsor's alone. — ProblemDetails

GET/api/v1/organizations/{organizationId}/custodial-vaults/{vaultId}/sensitive-role-key/rotation

How the custodian organisation's sensitive-role key rotation for the member's vault stands (FR-OBP.076, #21266).

Measured from the key id the Vault stored for each of this organisation's records. `remainingSourceItemIds` is the next batch of records still sealed to the retiring key, by this organisation's own item id; each drops out once re-sealed, so asking again returns the next batch.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The custodian organisation (must be the caller's).
`vaultId`	path	`string (uuid)`	yes	The member's vault.
`limit`	query	`integer (int32)`	no	At most this many remaining item ids (default 100, at most 500).

Request body

No request body.

Responses

200The current and retiring keys, the records still to re-seal, and the retired keys. — SensitiveRoleKeyRotationDto

403The caller does not administer an organisation. — ProblemDetails

404No such vault, or the organisation is not its custodian. — ProblemDetails

POST/api/v1/organizations/{organizationId}/custodial-vaults/{vaultId}/sensitive-role-key/rotation

The custodian organisation begins replacing its sensitive-role key for the member's vault, when a named holder is revoked or the key is compromised (FR-OBP.076, #21266).

The next key becomes the key every new `sensitive` record is sealed to. The current key starts retiring: it still counts as a custody key for the hand-over and the FR-OBP.088 invariant until every record sealed to it has been re-sealed (`PUT …/rotation/records`) and it is retired (`POST …/rotation/retire`). The next key must differ from the current key, the custodial key, the member's key, every key another sponsor's custody names and every key this custody has retired. A retry with the same next key is idempotent. Only the key id is kept.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The custodian organisation (must be the caller's).
`vaultId`	path	`string (uuid)`	yes	The member's vault.

Request body

Not marked as required in the document.

RotateSensitiveRoleKeyRequestDto as application/*+json, application/json, text/json

Responses

200The rotation is open (now, or already with this key); how it stands. — SensitiveRoleKeyRotationDto

400The body is malformed. — ProblemDetails

403The caller does not administer an organisation. — ProblemDetails

404No such vault, or the organisation is not its custodian. — ProblemDetails

409Custody is no longer held, no sensitive-role key is registered, another rotation is open, or the key cannot be this custody's. — ProblemDetails

PUT/api/v1/organizations/{organizationId}/custodial-vaults/{vaultId}/sensitive-role-key/rotation/records

The custodian organisation writes back one record it loaded, re-sealed in its processing zone from the retiring sensitive-role key to the current one (FR-OBP.076, #21266).

The record is named by this organisation's own item id. It must be sealed now to the retiring key, the key id must name the current key, and the envelope must keep the stored ciphertext, nonce and tag: only the wrapped content key may change. The prior envelope is kept as a restorable version. A retry for a record already re-sealed answers with `resealed: false` and changes nothing.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The custodian organisation (must be the caller's).
`vaultId`	path	`string (uuid)`	yes	The member's vault.

Request body

Not marked as required in the document.

ResealSensitiveRecordRequestDto as application/*+json, application/json, text/json

Responses

200Re-sealed (or already re-sealed); how many records are still sealed to the retiring key. — SensitiveRecordResealedDto

400The body is malformed. — ProblemDetails

403The caller does not administer an organisation. — ProblemDetails

404No such vault, the organisation is not its custodian, or it loaded no such item into it. — ProblemDetails

409No rotation is open. — ProblemDetails

422The record is not sealed to the retiring key, the key id is not the current key, the envelope is malformed, or it changes more than the wrapped key. — ProblemDetails

POST/api/v1/organizations/{organizationId}/custodial-vaults/{vaultId}/sensitive-role-key/rotation/retire

The custodian organisation retires the sensitive-role key its open rotation replaced (FR-OBP.076, #21266).

Refused while any of this organisation's records in the vault is still sealed to the retiring key. Otherwise the key stops counting as a custody key, and its retirement is recorded: the key, its replacement, when the rotation began and ended, who ended it, and how many records were sealed to the replacement. A retired key can never be this custody's sensitive-role key again.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The custodian organisation (must be the caller's).
`vaultId`	path	`string (uuid)`	yes	The member's vault.

Request body

No request body.

Responses

200The retirement record. — SensitiveRoleKeyRetirementDto

403The caller does not administer an organisation. — ProblemDetails

404No such vault, or the organisation is not its custodian. — ProblemDetails

409No rotation is open, or a record is still sealed to the retiring key. — ProblemDetails

GET/api/v1/programme-records/hand-over

Where the caller's programme records stand, in words the member is shown.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200The stage, the records sealed to the caller so far, and the member-facing message. — ProgrammeRecordsHandOverDto

404No programme record was held for the caller. — ProblemDetails

503A sovereign could not be asked; nothing is known, not "nothing there".

GET/api/v1/vaults/{vaultId}/hand-over

Where the hand-over of the member's records stands, in words the member is shown.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	The member organisation's vault.

Request body

No request body.

Responses

200The stage, the records secured so far, and the member-facing message. — CustodyHandOverStatusDto

404No such vault, it was never custodial, or it is not the caller's. — ProblemDetails

POST/api/v1/vaults/{vaultId}/hand-over/account-key

The engaging member's device publishes the member organisation's own key and becomes its key-holder, which starts securing the records to the member's account.

Only the user the vault's ownership bound to at engagement. The organisation's key is provisioned when it has none, or taken over from custody when it still publishes the custodial key; a retry with the same key is idempotent.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	The member organisation's custodial vault.

Request body

Not marked as required in the document.

PublishMemberAccountKeyRequestDto as application/*+json, application/json, text/json

Responses

200Published; the hand-over status as now measured. — CustodyHandOverStatusDto

400The body is malformed, or the key is the one the records were held in custody under. — ProblemDetails

404No such vault, it was never custodial, or the caller is not the member it bound to. — ProblemDetails

409Custody is not pending hand-over, or the organisation already publishes a key of its own. — ProblemDetails

GET/api/v1/vaults/{vaultId}/hand-over/custody-keys

The member's device fetches the custody keys its records are still held under, each delivered by its sponsor sealed to the member organisation's own key, so it can open those records and re-wrap them to its account.

Only the vault's bound owner who is an active holder of the member organisation's key. Each key reads `delivered` (with its envelope), `awaiting-delivery` or `sealed-to-replaced-key`; the whole reads `handed-over` once custody has ended and nothing is delivered any longer.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	The member's vault.

Request body

No request body.

Responses

200The custody keys and where each stands. — MemberCustodyKeysDto

404No such vault, it was never custodial, or the caller is not its member holding the organisation's key. — ProblemDetails

Dashboard

GET/api/v1/Dashboard/categories

Real per-semantic-category document counts for the authenticated user (derived from each document's schema category). Response is wrapped as `{ "data": [...] }` to match the web client contract.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200The user's category counts (possibly empty).

Data Requests

GET/api/v1/data-requests

List data requests

Retrieves a page of data requests filtered by targetUserId, requesterId, and/or status. Results are always bounded by pageNumber/pageSize (debt-2026-06-28-579).

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`targetUserId`	query	`string (uuid)`	no	—
`requesterId`	query	`string (uuid)`	no	—
`status`	query	`string`	no	—
`pageNumber`	query	`integer (int32)`	no	—
`pageSize`	query	`integer (int32)`	no	—

Request body

No request body.

Responses

200Data requests retrieved successfully. — DataRequestSummaryDtoPagedResultDto

400Invalid filter or paging parameters. — ProblemDetails

401User is not authenticated. — ProblemDetails

POST/api/v1/data-requests

Create a data request

Creates a new data request. The returned ShareToken is used to generate a QR code or platform link for the target user.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

CreateDataRequestCommand as application/*+json, application/json, text/json

Responses

201Data request created successfully. — DataRequestDto

400Invalid request data. — ProblemDetails

401User is not authenticated. — ProblemDetails

422The request cannot be addressed to that recipient: this instance holds no vault for it (#14131). — ProblemDetails

429This requester already has the maximum number of unanswered requests for this recipient (DD-040). — ProblemDetails

GET/api/v1/data-requests/by-token/{token}

Get data request by share token

Retrieves a data request using the token embedded in a QR code or platform link. Anonymous access is permitted so unauthenticated users can review the request before logging in.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`token`	path	`string`	yes	—

Request body

No request body.

Responses

200Data request retrieved successfully. — AnonymousDataRequestDto

404No data request found for the given token. — ProblemDetails

POST/api/v1/data-requests/injections/targeted

Inject a document (targeted)

Organisation injects a document directly to a known platform user with their consent (FR-02.029). The injection awaits the recipient's acceptance.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

InjectTargetedDocumentCommand as application/*+json, application/json, text/json

Responses

201Injection created successfully. — DataRequestDto

400Invalid request data, missing/invalid consent reference, or the consent grant does not authorise this injection. — ProblemDetails

401User is not authenticated. — ProblemDetails

403Caller is not an organisation principal, or does not control the injected document. — ProblemDetails

404The injected document does not exist. — ProblemDetails

503The Consent Service is temporarily unavailable; the consent check could not complete.

POST/api/v1/data-requests/injections/unmatched

Inject a document (unmatched)

Organisation injects a document for an as-yet-unidentified recipient (FR-02.028). Returns a claim ShareToken; the injection is auto-matched when the match hint resolves a user, else held unmatched until claimed or TTL-purged.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

InjectUnmatchedDocumentCommand as application/*+json, application/json, text/json

Responses

201Injection created successfully. — DataRequestDto

400Invalid request data. — ProblemDetails

401User is not authenticated. — ProblemDetails

403Caller is not an organisation principal, or does not control the injected document. — ProblemDetails

404The injected document does not exist. — ProblemDetails

POST/api/v1/data-requests/injections/{id}/accept

Accept an injected document

The recipient accepts an injected document. An unmatched injection is claimed and bound to the accepting user; a targeted injection is confirmed.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200Injection accepted successfully. — DataRequestDto

400Injection is no longer pending or is not an injection. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User is not the intended recipient. — ProblemDetails

404Injection not found. — ProblemDetails

GET/api/v1/data-requests/injections/{id}/document

Download an injected document

Returns the stored ciphertext and envelope of a document injected to the caller. Only the injection's bound target can read it, only while it is pending (and unexpired) or accepted. Every other case is 404, indistinguishable from an unknown id.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The injected document's ciphertext and envelope. — DocumentContentDto

401User is not authenticated. — ProblemDetails

404No injection this caller may read. — ProblemDetails

POST/api/v1/data-requests/injections/{id}/reject

Reject an injected document

The recipient rejects an injected document. An unmatched injection is bound to the rejecting user so the decline is attributable; a targeted injection may only be rejected by its intended recipient.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200Injection rejected successfully. — DataRequestDto

400Injection is no longer pending or is not an injection. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User is not the intended recipient. — ProblemDetails

404Injection not found. — ProblemDetails

GET/api/v1/data-requests/pending

List the caller's pending data requests

Retrieves a page of the caller's incoming data requests in the Pending status — those addressed to them and awaiting review. Bounded by pageNumber/pageSize.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`pageNumber`	query	`integer (int32)`	no	—
`pageSize`	query	`integer (int32)`	no	—

Request body

No request body.

Responses

200Pending data requests retrieved successfully. — DataRequestSummaryDtoPagedResultDto

400Invalid paging parameters. — ProblemDetails

401User is not authenticated. — ProblemDetails

POST/api/v1/data-requests/{id}/approve

Approve a data request

Target user approves the data request, specifying which fields are approved and which are declined.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

ApproveDataRequestCommand as application/*+json, application/json, text/json

Responses

200Data request approved successfully. — DataRequestDto

400Invalid request data or request is no longer pending. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Data request not found, or the caller is not its intended recipient (the two are intentionally indistinguishable). — ProblemDetails

POST/api/v1/data-requests/{id}/reject

Reject a data request

Target user explicitly declines the data request.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

204Data request rejected successfully.

400Request is no longer pending. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Data request not found, or the caller is not its intended recipient (the two are intentionally indistinguishable). — ProblemDetails

DelegatedWrites

POST/api/v1/delegated-writes

Record a delegated write

Captures that the authenticated delegate performed a write on behalf of the named principal.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

RecordDelegatedWriteRequestDto as application/*+json, application/json, text/json

Responses

201The recorded attribution. — DelegatedWriteAttributionDto

400The request failed validation (e.g. delegate == principal, or no delegation grant cited). — ProblemDetails

403The named principal does not own the target vault, or the cited delegation grant does not authorise this delegate to act for that principal (debt-2026-08-13-202). — ProblemDetails

404The target vault was not found. — ProblemDetails

503The granting service was unreachable, so the delegation could not be verified.

GET/api/v1/delegated-writes/on-behalf-of-me

My delegated-write feed

Every write a delegate made on behalf of the authenticated principal, newest first.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	query	`string (uuid)`	no	—

Request body

No request body.

Responses

200The delegated-write feed (possibly empty). — DelegatedWriteAttributionDto[]

Derived Shares

GET/api/v1/vault/derived-shares/preview

Preview vault teardown for a consent revocation

Returns the derived shares and cached copies that revoking the given consent grants would tear down.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`consentIds`	query	`string`	no	Comma-separated consent identifiers (GUIDs).

Request body

No request body.

Responses

200Preview computed. — DerivedSharesPreviewDto

400Invalid or missing consentIds. — ProblemDetails

401User is not authenticated. — ProblemDetails

GET/api/v1/vault/derived-shares/reconciliation

Reconcile a bulk-revocation batch's teardown

Returns confirmed vs pending teardown counts for the batch, driven by the FieldShareRevoked cascade.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`batchId`	query	`string (uuid)`	no	The batch identifier returned by registration.

Request body

No request body.

Responses

200Reconciliation computed. — DerivedShareReconciliationDto

400Missing or invalid batchId. — ProblemDetails

401User is not authenticated. — ProblemDetails

404No such batch for this user. — ProblemDetails

POST/api/v1/vault/derived-shares/revocation-batch

Creates a durable correlation record so a subsequent reconciliation call can resolve the batch by id.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

RegisterDerivedShareRevocationBatchCommand as application/*+json, application/json, text/json

Responses

201Batch registered. — DerivedShareRevocationBatchDto

400Invalid request. — ProblemDetails

401User is not authenticated. — ProblemDetails

409The batchId already exists and is owned by another user. — ProblemDetails

Document Search

POST/api/v1/Documents/search

Search documents with advanced filters

Performs advanced document search with full-text search, comprehensive filtering, relevance scoring, and pagination. Only searches unencrypted metadata fields (zero-knowledge compliant). User must own the specified vault.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

DocumentSearchRequest as application/*+json, application/json, text/json

Responses

200Search completed successfully. — DocumentSearchDtoSearchResult

400Invalid search parameters. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not own the vault. — ProblemDetails

GET/api/v1/Documents/search/facets

Get search facets

Retrieves dynamic search facets showing aggregated filter options for file types, categories, and extensions. Helps users discover available filters and understand document distribution.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	query	`string (uuid)`	no	The vault ID to generate facets for.
`query`	query	`string`	no	Optional search query to filter facets (only show facets for matching documents).

Request body

No request body.

Responses

200Facets retrieved successfully. — SearchFacet[]

401User is not authenticated. — ProblemDetails

403User does not own the vault. — ProblemDetails

GET/api/v1/Documents/search/suggestions

Get search suggestions

Retrieves autocomplete suggestions for search queries based on document filenames, tags, and category names. Returns mixed suggestions prioritized by relevance and usage frequency.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	query	`string (uuid)`	no	The vault ID to search within.
`query`	query	`string`	no	The search query prefix (minimum 2 characters).
`limit`	query	`integer (int32)`	no	Maximum number of suggestions to return (default: 10, max: 50).

Request body

No request body.

Responses

200Suggestions retrieved successfully. — SearchSuggestion[]

400Invalid query parameters. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not own the vault. — ProblemDetails

GET/api/v1/Shares/{token}

Access document via share token

Accesses a document via its share token. No authentication required. Validates that the share is not expired or revoked. Every successful resolution is recorded for audit; the access write cannot be suppressed by the caller.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`token`	path	`string`	yes	The share token.

Request body

No request body.

Responses

200Document share accessed successfully. — PublicDocumentShareDto

404Share not found, expired, or revoked. — ProblemDetails

GET/api/v1/documents/{id}/shares

Get document shares

Retrieves a document's live shares. Set includeExpired and/or includeRevoked to also return shares that have lapsed or been revoked, so an owner can audit past access. User must own the vault containing the document.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.
`includeExpired`	query	`boolean`	no	Include shares whose expiry has passed (default false).
`includeRevoked`	query	`boolean`	no	Include shares the owner has revoked (default false).

Request body

No request body.

Responses

200Document shares retrieved successfully. — DocumentShareDto[]

401User is not authenticated. — ProblemDetails

403User does not own the vault containing this document. — ProblemDetails

404Document not found. — ProblemDetails

POST/api/v1/documents/{id}/shares

Create document share

Creates a new share for a document, generating a cryptographically secure share token. Supports version-specific or document-wide sharing with View or Edit permissions. Can create private (user-specific) or public (anonymous) shares.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.

Request body

Not marked as required in the document.

CreateDocumentShareCommand as application/*+json, application/json, text/json

Responses

201Document share created successfully. — DocumentShareDto

400Invalid request data. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not own the vault containing this document. — ProblemDetails

404Document not found. — ProblemDetails

GET/api/v1/documents/{id}/shares/{shareId}

Get document share by ID

Retrieves a specific document share by ID. User must own the vault containing the document.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.
`shareId`	path	`string (uuid)`	yes	The share ID.

Request body

No request body.

Responses

200Document share retrieved successfully. — DocumentShareDto

401User is not authenticated. — ProblemDetails

403User does not own the vault containing this document. — ProblemDetails

404Document or share not found. — ProblemDetails

DELETE/api/v1/documents/{id}/shares/{shareId}

Revoke document share

Revokes a document share by marking it as revoked. The share token becomes invalid immediately. User must own the vault containing the document.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.
`shareId`	path	`string (uuid)`	yes	The share ID.

Request body

No request body.

Responses

204Share revoked successfully.

401User is not authenticated. — ProblemDetails

403User does not own the vault containing this document. — ProblemDetails

404Document or share not found. — ProblemDetails

POST/api/v1/documents/{id}/shares/{shareId}/accept

Accept document share

Records the recipient's acceptance of a private document share and publishes a ShareAccepted event so the owner is notified. Only the designated recipient may accept.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.
`shareId`	path	`string (uuid)`	yes	The share ID to accept.

Request body

No request body.

Responses

200Share accepted successfully. — DocumentShareDto

401User is not authenticated. — ProblemDetails

403Caller is not the designated recipient of the share. — ProblemDetails

404Document or share not found. — ProblemDetails

409Share is not in an acceptable state. — ProblemDetails

PUT/api/v1/documents/{id}/shares/{shareId}/expiration

Extend share expiration

Extends the expiration date of a document share. Cannot extend a revoked share. User must own the vault containing the document.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.
`shareId`	path	`string (uuid)`	yes	The share ID.

Request body

Not marked as required in the document.

ExtendShareExpirationCommand as application/*+json, application/json, text/json

Responses

200Share expiration extended successfully. — DocumentShareDto

400Invalid request data or share already revoked. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not own the vault containing this document. — ProblemDetails

404Document or share not found. — ProblemDetails

PUT/api/v1/documents/{id}/shares/{shareId}/permission

Update share permission

Updates the permission level of a document share (View or Edit). User must own the vault containing the document.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.
`shareId`	path	`string (uuid)`	yes	The share ID.

Request body

Not marked as required in the document.

UpdateSharePermissionCommand as application/*+json, application/json, text/json

Responses

200Share permission updated successfully. — DocumentShareDto

400Invalid request data. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not own the vault containing this document. — ProblemDetails

404Document or share not found. — ProblemDetails

Documents

GET/api/v1/Documents

Search documents with advanced filters

Retrieves a paginated list of documents using Elasticsearch-powered search with support for filtering by categories, file types, tags, date ranges, file sizes, and fuzzy matching. Only searches unencrypted metadata (zero-knowledge compliant). Only returns documents from vaults owned by the authenticated user. When vaultId is omitted, the caller's own default vault is used.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	query	`string (uuid)`	no	Vault ID to filter documents (required).
`searchTerm`	query	`string`	no	Optional search term for filename, category name, and tags matching (supports fuzzy search).
`categoryIds`	query	`(string (uuid))[]`	no	Optional list of category IDs to filter documents.
`fileTypes`	query	`string[]`	no	Optional list of file types/extensions to filter (e.g., ".pdf", ".jpg").
`tags`	query	`string[]`	no	Optional list of tags to filter documents.
`dateFrom`	query	`string (date-time)`	no	Optional start date for filtering by creation date.
`dateTo`	query	`string (date-time)`	no	Optional end date for filtering by creation date.
`minFileSizeBytes`	query	`integer (int64)`	no	Optional minimum file size in bytes.
`maxFileSizeBytes`	query	`integer (int64)`	no	Optional maximum file size in bytes.
`sortBy`	query	`string`	no	Sort field: "fileName", "createdAt", "updatedAt", "fileSize", or "relevance" (default: "relevance").
`sortAscending`	query	`boolean`	no	Sort order: true for ascending, false for descending (default: false).
`enableFuzzySearch`	query	`boolean`	no	Enable fuzzy search for typo tolerance (default: true).
`includeFacets`	query	`boolean`	no	Include faceted search aggregations for categories, file types, and tags (default: false).
`archiveScope`	query	`DocumentArchiveScope`	no	—
`pageNumber`	query	`integer (int32)`	no	The page number (default: 1).
`pageSize`	query	`integer (int32)`	no	The page size (default: 10, max: 100).

Request body

No request body.

Responses

200Document list retrieved successfully with search metadata. — SearchResultDto

400Invalid search parameters. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not own the vault. — ProblemDetails

POST/api/v1/Documents

Add document to vault

Adds a new encrypted document to a vault. All document data must be encrypted client-side before upload. Validates vault ownership, status, and storage quota.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

AddDocumentCommand as application/*+json, application/json, text/json

Responses

201Document added successfully. — DocumentDto

400Invalid request data or vault quota exceeded. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not own the vault or vault is inactive. — ProblemDetails

404Vault not found. — ProblemDetails

428Account recovery must be set up before this vault can grow (graduated trust, D-121). — ProblemDetails

GET/api/v1/Documents/by-format/{format}

Get documents by content format

Returns a paginated list of a vault's documents whose contentFormat matches (e.g. fhir-r4/Observation). Only unencrypted type metadata is returned (zero-knowledge). CC-062 / FR-02.065.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	query	`string (uuid)`	no	—
`format`	path	`string`	yes	—
`pageNumber`	query	`integer (int32)`	no	—
`pageSize`	query	`integer (int32)`	no	—
`fhirCodingSystem`	query	`string`	no	—
`fhirCodingCode`	query	`string`	no	—

Request body

No request body.

Responses

200Documents retrieved successfully. — DocumentDtoPagedResultDto

400Invalid query parameters. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Vault not found or not owned by the caller. — ProblemDetails

GET/api/v1/Documents/candidates

List the caller's own documents that could answer a requested check

Projects the authenticated caller's own documents matching the schemas a data-request check asks for, each with its schema-declared data-classification level and per-field requiredForCheck flags. Reads the caller's vaults only.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`requestId`	query	`string (uuid)`	no	The data request naming the check.
`checkId`	query	`string`	no	The check within that request.

Request body

No request body.

Responses

200Candidate documents for the check. — CandidateDocumentsDto

400Invalid request or check identifier. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Data request not found, or the caller is not its target (the two are intentionally indistinguishable). — ProblemDetails

GET/api/v1/Documents/presence

Bulk-retrieves a vault's documents of a given content format, paginated (CC-062 / FR-02.065).

Enables a consumer (e.g. EPIC 21 Healthcare) to page all documents of one FHIR resource type — for example `fhir-r4/Patient` — without decrypting content. The `{format}` route is a catch-all so a slash-bearing format (`fhir-r4/Patient`) is captured verbatim. Zero-knowledge: only unencrypted type metadata is returned.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`schemaRefs`	query	`string[]`	no	Repeated or comma-separated schema refs (e.g. `module.civic.care-record.v1`).

Request body

No request body.

Responses

200Documents retrieved successfully. — DocumentPresenceDto

400Invalid query parameters. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Vault not found or not owned by the caller.

GET/api/v1/Documents/trash

List trashed (soft-deleted) documents

Retrieves the soft-deleted documents in a vault for the Trash / Recently-Deleted recovery view, enriched with recovery-window metadata (recovery window days, purge-eligible timestamp, days remaining). Only the vault owner may view its trash.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	query	`string (uuid)`	no	The vault whose trash is requested (required).
`pageNumber`	query	`integer (int32)`	no	The 1-based page number (default: 1).
`pageSize`	query	`integer (int32)`	no	The page size (default: 50, server-enforced max: 100).

Request body

No request body.

Responses

200Trash retrieved successfully. — ListDeletedDocumentsQueryResult

400The required vaultId is missing or not a GUID. — ProblemDetails

401User is not authenticated. — ProblemDetails

403The caller is not the owner of the vault (or it does not exist). — ProblemDetails

GET/api/v1/Documents/{id}

Get document by id

Retrieves a document's unencrypted metadata and current encryption envelope. Pass keyGeneration to assert the generation you will decrypt with; a purged (older) generation returns 409 key_generation_purged (FR-02.011 dual-key window) rather than a silent wrong-key read.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.
`keyGeneration`	query	`integer (int32)`	no	Optional key generation the caller intends to decrypt with. If older than the document's current generation (rotation completed), the read is rejected with 409 `key_generation_purged` — never a silent wrong-key decrypt (FR-02.011).

Request body

No request body.

Responses

200Document retrieved successfully. — DocumentDto

401User is not authenticated. — ProblemDetails

404Document not found or not owned by the caller. — ProblemDetails

409The requested key generation has been purged. — ProblemDetails

DELETE/api/v1/Documents/{id}

Delete document

Soft deletes a document and revokes every share that depends on it, notifying the recipients. The encrypted data is retained for the retention window and can be restored. Returns what the cascade revoked. To keep the dependent consents live, archive the document instead (POST {id}/archive). User must own the vault containing the document.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.

Request body

No request body.

Responses

200Document deleted; the body reports the shares revoked and recipients notified. — DocumentDeletionResultDto

204Document deleted successfully.

401User is not authenticated. — ProblemDetails

403User does not own the vault containing this document.

404Document not found or not owned by the caller. — ProblemDetails

POST/api/v1/Documents/{id}/archive

Archive a document (or confirm its sensitivity label)

Takes the document out of the holder's default listing without revoking any share that depends on it, without notifying any recipient, and without starting a retention clock. Idempotent. On /{id}/sensitivity-label/{label} the vault's owner instead confirms or raises the record's sensitivity label (standard | personal | sensitive); a lower label on a record a sponsor loaded is held for that sponsor's reviewer (202).

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document to archive.
`label`	path	`string`	yes	On the sensitivity-label route only: `standard \| personal \| sensitive`.

Request body

No request body.

Responses

200Document archived, or its label confirmed. — DocumentDto

202The label is lower than the record's and a sponsor loaded it: held for that sponsor's reviewer. — DocumentDto

400The label is not standard, personal or sensitive. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Document not found or not owned by the caller. — ProblemDetails

PUT/api/v1/Documents/{id}/content

Replace document content

Replaces an existing document's client-encrypted content as a versioned correction (EPIC 89 FR-DCI.019, EPIC 5 FR-05.025). The overwritten state is retained as a version snapshot and the replacement becomes the current version. Requires vault ownership.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.

Request body

Not marked as required in the document.

ReplaceDocumentContentRequestDto as application/*+json, application/json, text/json

Responses

200Content replaced successfully. — DocumentDto

400Invalid request data or vault storage quota exceeded. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Document not found or not owned by the caller. — ProblemDetails

409Duplicate content in this vault, the vault is inactive, or the supplied expectedRowVersion is stale (FR-02.032). — ProblemDetails

428Replacement would grow the vault and account recovery is not set up (graduated trust, D-121). — ProblemDetails

GET/api/v1/Documents/{id}/download

Download encrypted document content

Returns a document's stored ciphertext (Base64) together with the CC-013 encryption envelope (nonce, auth tag, algorithm, key generation, HKDF context) needed to decrypt it client-side. Zero-knowledge: the server never sees or returns plaintext.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.

Request body

No request body.

Responses

200Encrypted content retrieved successfully. — DocumentContentDto

401User is not authenticated. — ProblemDetails

404Document not found, not owned by the caller, or has no stored content. — ProblemDetails

GET/api/v1/Documents/{id}/download/stream

Stream encrypted document content

Streams a document's stored ciphertext as application/octet-stream, with the CC-013 encryption envelope (nonce, auth tag, algorithm, key generation, HKDF context) as base64url JSON in the X-Essence-Content-Envelope header. Never buffers the body; never returns plaintext.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.

Request body

No request body.

Responses

200Ciphertext streamed. — string (binary)

401User is not authenticated. — ProblemDetails

404Document not found, not owned by the caller, or has no stored content. — ProblemDetails

500The document's stored content could not be read (document-content-missing).

PUT/api/v1/Documents/{id}/encryption-metadata

Update document encryption metadata

Replaces the stored encryption envelope for a document after a client-side key rotation. Updates IV/nonce, authentication tag, algorithm version, key derivation, and key generation. Requires vault ownership. Content and version are unchanged.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.

Request body

Not marked as required in the document.

UpdateEncryptionMetadataRequestDto as application/*+json, application/json, text/json

Responses

200Encryption metadata updated successfully. — DocumentDto

400Invalid envelope data or the document is deleted. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not own the vault containing this document.

404Document not found or not owned by the caller. — ProblemDetails

409The supplied expectedRowVersion is stale; re-fetch the document and retry. — ProblemDetails

GET/api/v1/Documents/{id}/locate

Locate one of the caller's own documents across their vaults

Returns metadata only: vault, jurisdiction, schema and sealed-field count.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document id that resolved nowhere in the active vault.

Request body

No request body.

Responses

200Where the document lives. — DocumentLocationDto

401Unauthorized — ProblemDetails

404Not found in any vault the caller owns. — ProblemDetails

GET/api/v1/Documents/{id}/renewal-diff/{replacementId}

Read both documents' sealed fields for a renewal diff

Returns ciphertext for both documents so the client can decrypt and compare. The server does no comparing.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document being renewed.
`replacementId`	path	`string (uuid)`	yes	The document replacing it.

Request body

No request body.

Responses

200Both documents' sealed fields. — RenewalFieldEnvelopesDto

401Unauthorized — ProblemDetails

404Document not found or not owned by the caller. — ProblemDetails

POST/api/v1/Documents/{id}/restore

Restore a trashed document

Restores a soft-deleted document by reversing its soft-delete tombstone. Document content and versions are unchanged. Requires ownership of the vault containing the document.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID to restore.

Request body

No request body.

Responses

200Document restored successfully. — DocumentDto

401User is not authenticated. — ProblemDetails

404Document not found or not owned by the caller. — ProblemDetails

409Document is not currently deleted (nothing to restore). — ProblemDetails

POST/api/v1/Documents/{id}/sensitivity-label/{label}

Archive a document (or confirm its sensitivity label)

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document to archive.
`label`	path	`string`	yes	On the sensitivity-label route only: `standard \| personal \| sensitive`.

Request body

No request body.

Responses

200Document archived, or its label confirmed. — DocumentDto

202The label is lower than the record's and a sponsor loaded it: held for that sponsor's reviewer. — DocumentDto

400The label is not standard, personal or sensitive. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Document not found or not owned by the caller. — ProblemDetails

POST/api/v1/Documents/{id}/supersedes/{supersededId}

Record that this document replaces another

Records the renewal relation and returns the recipients who currently read the replaced document. Moves no access.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The new document, taking the old one's place.
`supersededId`	path	`string (uuid)`	yes	The document being replaced.

Request body

No request body.

Responses

200Relation recorded. — DocumentSupersessionResponse

401User is not authenticated. — ProblemDetails

404Document not found or not owned by the caller. — ProblemDetails

409A different replacement is already recorded. — ProblemDetails

POST/api/v1/Documents/{id}/unarchive

Unarchive a document

Returns an archived document to the holder's default listing. Idempotent.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document to unarchive.

Request body

No request body.

Responses

200Document unarchived. — DocumentDto

401User is not authenticated. — ProblemDetails

404Document not found or not owned by the caller. — ProblemDetails

POST/api/v1/documents/care-link-deliveries

Deliver a sealed item under a care link

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`consentGrantId`	query	`string (uuid)`	no	The care-link grant the delivery relies on.

Request body

Not marked as required in the document.

AddDocumentCommand as application/*+json, application/json, text/json

Responses

201Delivered. — DocumentDto

403No live care link from this child's family to the caller's organisation, or it is not for this vault. — ProblemDetails

503The consent service could not be consulted; nothing was delivered.

GET/api/v1/documents/{id}/activity

Get document activity

Retrieves a bounded page of the access records the server holds against a document — each one an envelope, field or download serve, newest first. Identifiers, kinds and instants only: the server cannot read the document and holds no actor names, addresses or free-form metadata to report.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.
`activityType`	query	`string[]`	no	Optional repeated filter on activity kind (`envelope-served`, `field-served`, `download-served`).
`actorId`	query	`string (uuid)`	no	Optional filter to a single acting principal.
`fromDate`	query	`string (date-time)`	no	Optional inclusive lower time bound (UTC).
`toDate`	query	`string (date-time)`	no	Optional inclusive upper time bound (UTC).
`page`	query	`integer (int32)`	no	1-based page number (default 1).
`pageSize`	query	`integer (int32)`	no	Page size (default 50, server ceiling 100).

Request body

No request body.

Responses

200Activity page retrieved successfully. — DocumentActivityPageDto

400An activity-type token or date range was not understood. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not have access to the vault containing this document. — ProblemDetails

404Document not found. — ProblemDetails

GET/api/v1/documents/{id}/ownership

Check document ownership (service-to-service)

Returns whether the given userId owns the given document. Used by industry modules (e.g. EPIC 30 Family) that hold no document storage of their own to verify ownership against the authoritative Core Document/Vault service before creating a cross-vault sharing record, instead of trusting a caller-supplied documentId blindly.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document id.
`userId`	query	`string (uuid)`	no	The user whose ownership is being asserted.

Request body

No request body.

Responses

200Ownership result. — DocumentOwnershipDto

401User is not authenticated. — ProblemDetails

403The caller is not a service principal holding the ownership-check scope. — ProblemDetails

GET/api/v1/documents/{id}/statistics

Get document statistics

Retrieves aggregate counters for a document: envelope/field serves ('views'), download serves, distinct principals for each, the most recent serve, the active-share count and the retained version count. 'Views' means envelopes the server handed out — the closest honest signal a zero-knowledge platform has, since a client decrypting a cached copy is invisible to the server.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.

Request body

No request body.

Responses

200Statistics retrieved successfully. — DocumentStatisticsDto

401User is not authenticated. — ProblemDetails

403User does not have access to the vault containing this document. — ProblemDetails

404Document not found. — ProblemDetails

POST/api/v1/documents/{id}/tags

Add document tags

Adds one or more opaque tags to a document. Adding a tag the document already carries is ignored, so the call is idempotent under retry. Tags are matched byte-for-byte because they may themselves be client-encrypted.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.

Request body

Not marked as required in the document.

AddDocumentTagsRequestDto as application/*+json, application/json, text/json

Responses

200Tags added; the updated document is returned. — DocumentDto

400A tag was invalid or the per-document cap would be exceeded. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not have write access to the vault containing this document. — ProblemDetails

404Document not found. — ProblemDetails

DELETE/api/v1/documents/{id}/tags/{tag}

Remove a document tag

Removes one tag from a document. Removing a tag the document does not carry is not an error: the caller's intent — that the tag is gone — already holds, and reporting 404 would make an idempotent retry look like a failure.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.
`tag`	path	`string`	yes	The tag to remove (URL-encoded; matched byte-for-byte).

Request body

No request body.

Responses

200Tag removed (or was not present); the updated document is returned. — DocumentDto

400The tag was invalid or the document is deleted. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not have write access to the vault containing this document. — ProblemDetails

404Document not found. — ProblemDetails

GET/api/v1/documents/{id}/versions

Get document version history

Retrieves a bounded page of a document's versions ordered by version number (newest first). Each version includes metadata snapshot and encryption information. Use pageNumber/pageSize to page; pageSize is capped server-side at 100. User must own the vault containing the document.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.
`pageNumber`	query	`integer (int32)`	no	The 1-based page number (default: 1).
`pageSize`	query	`integer (int32)`	no	The page size (default: 50, server-enforced ceiling: 100).

Request body

No request body.

Responses

200Version history retrieved successfully. — GetDocumentVersionHistoryQueryResult

401User is not authenticated. — ProblemDetails

403User does not own the vault containing this document. — ProblemDetails

404Document not found. — ProblemDetails

POST/api/v1/documents/{id}/versions

Create document version

Creates a new version snapshot of a document, capturing current metadata and encryption state. The new version becomes the current version. User must own the vault containing the document.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.

Request body

Not marked as required in the document.

CreateDocumentVersionCommand as application/*+json, application/json, text/json

Responses

201Document version created successfully. — DocumentVersionDto

400Invalid request data or maximum versions reached. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not own the vault containing this document. — ProblemDetails

404Document not found. — ProblemDetails

GET/api/v1/documents/{id}/versions/compare

Compare document versions

Compares two versions of a document, highlighting differences in metadata fields. User must own the vault containing the document.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.
`fromVersion`	query	`integer (int32)`	no	The starting version number for comparison.
`toVersion`	query	`integer (int32)`	no	The ending version number for comparison.

Request body

No request body.

Responses

200Version comparison completed successfully. — CompareDocumentVersionsQueryResult

400Invalid version numbers. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not own the vault containing this document. — ProblemDetails

404Document or versions not found. — ProblemDetails

GET/api/v1/documents/{id}/versions/{versionNumber}

Get specific document version

Retrieves a specific version of a document by version number. Returns the metadata snapshot and encryption information for that version. User must own the vault containing the document.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.
`versionNumber`	path	`integer (int32)`	yes	The version number to retrieve.

Request body

No request body.

Responses

200Document version retrieved successfully. — DocumentVersionDto

401User is not authenticated. — ProblemDetails

403User does not own the vault containing this document. — ProblemDetails

404Document or version not found. — ProblemDetails

POST/api/v1/documents/{id}/versions/{versionNumber}/rollback

Rollback document to version

Rolls back a document to a specific version by restoring its metadata from that version's snapshot. Creates a new version after rollback. User must own the vault containing the document.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The document ID.
`versionNumber`	path	`integer (int32)`	yes	The version number to rollback to.

Request body

Not marked as required in the document.

RollbackDocumentVersionCommand as application/*+json, application/json, text/json

Responses

200Document rolled back successfully. — DocumentDto

400Invalid request data or version not found. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not own the vault containing this document. — ProblemDetails

404Document or version not found. — ProblemDetails

409The supplied expectedRowVersion is stale; re-fetch the document and retry. — ProblemDetails

POST/api/v1/organizations/{organizationId}/migration-documents

Store one migrated, organisation-sealed record as a document

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The organisation the record belongs to.

Request body

Not marked as required in the document.

MigrationDocumentLoadRequestDto as application/*+json, application/json, text/json

Responses

200Already stored by an earlier load of the same record; nothing stored or charged. — MigrationDocumentLoadResultDto

201Stored as a new document. — MigrationDocumentLoadResultDto

409The organisation cannot receive it: no single active default vault, or no active key. — ProblemDetails

422It is not sealed to the organisation's active key, or is not a well-formed envelope. — ProblemDetails

POST/api/v1/users/{userId}/issued-credentials

Deposit an issued credential into the holder's vault

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`userId`	path	`string (uuid)`	yes	The holder: the credential's subject.

Request body

Not marked as required in the document.

IssuedCredentialDepositRequestDto as application/*+json, application/json, text/json

Responses

200This credential was already deposited; nothing stored or charged. — IssuedCredentialDepositResultDto

201Stored as a new document. — IssuedCredentialDepositResultDto

400The body is malformed. — ProblemDetails

404The holder has no active personal vault on this instance. — ProblemDetails

409The holder has more than one default personal vault. — ProblemDetails

422The credential is not sealed to one of the holder's keys, or is not a well-formed envelope. — ProblemDetails

GET/api/v1/vaults/supplier-portal-upload-target

Resolve a supplier-portal upload's receiving vault and wrap key

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`X-Upload-Authorization`	header	`string`	no	The signed upload-target request.

Request body

No request body.

Responses

200The receiving vault and the key to seal to. — SupplierPortalUploadTargetDto

403The request is missing, invalid or expired. — ProblemDetails

409The buyer has no single active default organisation vault, or no active organisation key. — ProblemDetails

POST/api/v1/vaults/{vaultId}/supplier-portal-documents

Store a supplier-portal upload under a single-use authorisation

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	The buyer's organisation vault.
`X-Upload-Authorization`	header	`string`	no	The single-use upload authorisation.

Request body

Not marked as required in the document.

SupplierPortalDocumentUploadRequestDto as application/*+json, application/json, text/json

Responses

201Stored. — DocumentDto

403The authorisation is missing, invalid, expired, or not bound to this vault and content. — ProblemDetails

409The authorisation has already been used, or the vault refuses the write (duplicate content, inactive vault). — ProblemDetails

Estate Bequests

GET/api/v1/vault/estates/{estateId}/bequeathed-documents

List documents left to you

Projects only the items the deceased bequeathed to the authenticated executor, each with its release-tier availability. Authorised by the verified estate release, not a consent grant.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`estateId`	path	`string (uuid)`	yes	The estate to project bequeathed documents for.

Request body

No request body.

Responses

200The bequeathed-documents projection (empty until the estate is released). — BequeathedDocumentDto[]

401User is not authenticated. — ProblemDetails

POST/api/v1/vault/estates/{estateId}/bequests

Declare a bequeathed document

Records that a document is left to a named executor, opening the estate's bequest set on first use.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`estateId`	path	`string (uuid)`	yes	The estate the bequest belongs to.

Request body

Not marked as required in the document.

DeclareBequestRequestDto as application/*+json, application/json, text/json

Responses

201The bequest was declared; the created item id is returned. — BequestDeclaredResponseDto

400Invalid request data. — ProblemDetails

401User is not authenticated. — ProblemDetails

404The estate's bequest set belongs to another owner. — ProblemDetails

POST/api/v1/vault/estates/{estateId}/release-authorization

Authorise a verified estate release

Records the posthumous authorisation that unlocks the bequest projection for the estate's executors. Restricted to the upstream verified-release seam: recording a release is an attestation that the owner has died, so neither a named executor nor the owner's own credential may perform it.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`estateId`	path	`string (uuid)`	yes	The estate whose release is being authorised.

Request body

Not marked as required in the document.

AuthorizeEstateReleaseRequestDto as application/*+json, application/json, text/json

Responses

200The release was recorded (or was already recorded — idempotent). — EstateReleaseAuthorizationResultDto

400Invalid request data. — ProblemDetails

401User is not authenticated. — ProblemDetails

403The caller does not hold the estate-release authority. — ProblemDetails

404No bequest set exists for the estate. — ProblemDetails

Family Member Vaults

POST/api/v1/vaults/family-members

Provision a family-member vault

Creates a family member's own independent, client-encrypted vault billed to the authenticated sponsor's family plan. Idempotent on (member, family-plan).

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

ProvisionFamilyMemberVaultRequestDto as application/*+json, application/json, text/json

Responses

201Member vault provisioned. — FamilyMemberVaultProvisionedDto

400Invalid request. — ProblemDetails

401Caller is not authenticated. — ProblemDetails

409The member cannot be the sponsor. — ProblemDetails

503Entitlement/quota authority unavailable (fail-closed).

FamilyWards

GET/api/v1/family/wards

List the caller's wards

Returns every ward the authenticated guardian manages, with its supervised→adult lifecycle status, graduation date and per-guardian roles. Scoped strictly to the caller.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200The caller's ward roster (an empty list when they manage none). — WardSummaryDto[]

401The caller is not authenticated. — ProblemDetails

Field Shares

GET/api/v1/crossings

Border crossings out of the caller's vaults

Per (document, recipient): distinct fields held, the recipient's recorded home region, and whether the holding left the vault's jurisdiction. Scoped to the caller; metadata only.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200Crossings retrieved. — VaultCrossings

401User is not authenticated. — ProblemDetails

GET/api/v1/documents/{docId}/fields

List field shares for document

Retrieves active field shares for a document, paginated. Only Status==Active rows are returned; revoked/expired shares are filtered server-side.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`docId`	path	`string (uuid)`	yes	The document identifier.
`pageNumber`	query	`integer (int32)`	no	The page number (1-based, default: 1).
`pageSize`	query	`integer (int32)`	no	The page size (default: 20, max: 100).

Request body

No request body.

Responses

200Field shares retrieved successfully. — FieldShareDtoPagedResultDto

400Invalid pagination parameters. — ProblemDetails

401User is not authenticated. — ProblemDetails

POST/api/v1/documents/{docId}/fields/share-batch

Share multiple fields

Shares up to the configured maximum fields-per-share (NFR-02.026) within a document in one request. Returns the per-field outcome; a request exceeding the cap is rejected with HTTP 400.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`docId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

CreateFieldShareCommand as application/*+json, application/json, text/json

Responses

200Batch processed; see per-field outcomes. — BatchFieldShareResultDto

400Invalid request data (no fields or fields-per-share cap exceeded). — ProblemDetails

401User is not authenticated. — ProblemDetails

503Consent service temporarily unavailable (degraded path).

POST/api/v1/documents/{docId}/fields/{fieldId}/share

Share a field

Shares a specific field within a document. The wrapped field encryption key enables the recipient to decrypt only this field.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`docId`	path	`string (uuid)`	yes	—
`fieldId`	path	`string`	yes	—

Request body

Not marked as required in the document.

ShareFieldCommand as application/*+json, application/json, text/json

Responses

201Field shared successfully. — FieldShareDto

400Invalid request data. — ProblemDetails

401User is not authenticated. — ProblemDetails

403The sharer holds as many fields under a live share as their plan includes (#8365). The problem body names the feature code, the allowance, the SKUs that lift it and an upgrade route. — ProblemDetails

409Active share already exists for this field/recipient combination. — ProblemDetails

422Edit-level field shares are not yet supported (SC-02.E). — ProblemDetails

GET/api/v1/documents/{documentId}/fields/{fieldId}/content

Read one field envelope

Returns one field's sealed envelope to the document owner or the holder of an Active field share on exactly this (document, field). Expiry, revocation and suspension are evaluated on every read.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`documentId`	path	`string (uuid)`	yes	—
`fieldId`	path	`string`	yes	—

Request body

No request body.

Responses

200The field envelope. — FieldContentDto

401User is not authenticated. — ProblemDetails

404The field does not exist, or the caller holds no live share on it — deliberately indistinguishable. — ProblemDetails

GET/api/v1/field-shares/organization-consent-ledger

Organisation consent ledger by counterparty

Per counterparty: distinct fields held, live consents, and the soonest expiry — plus the register rollup. Metadata only.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200Ledger retrieved. — OrganizationConsentLedger

401User is not authenticated. — ProblemDetails

DELETE/api/v1/field-shares/{id}

Revoke a field share

Revokes a field share, preventing further access by the recipient.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

204Field share revoked successfully.

401User is not authenticated. — ProblemDetails

403User is not the sharer. — ProblemDetails

404Field share not found. — ProblemDetails

409Field share is already in a terminal state (revoked or expired). — ProblemDetails

POST/api/v1/field-shares/{id}/resolve

Resolve a pending field share

FR-02.038: the original sharer resolves a recipient-key-unavailable pending share by submitting the field key wrapped with the recipient's now-registered key. The share becomes Active.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

ResolvePendingFieldShareCommand as application/*+json, application/json, text/json

Responses

200Pending field share resolved to active. — FieldShareDto

400Invalid request data. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User is not the sharer. — ProblemDetails

404Field share not found. — ProblemDetails

409Field share is not pending or has timed out. — ProblemDetails

POST/api/v1/field-shares/{id}/restore

Restore a suspended field share

Re-activates a suspended (Paused) field share. Returns 400 once the grace window has closed and the share has been permanently revoked.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200Field share restored. — FieldShareDto

400The share is not suspended (never suspended, or its grace window has closed). — ProblemDetails

401User is not authenticated. — ProblemDetails

403User is not the sharer. — ProblemDetails

404Field share not found. — ProblemDetails

POST/api/v1/field-shares/{id}/suspend

Suspend a field share (reversible hide)

Pauses a live field share so the recipient loses access, retaining the wrapped key so the same share can be restored. An optional graceWindowDays makes the suspension lapse to a permanent revocation.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The field share to suspend.

Request body

Not marked as required in the document.

SuspendFieldShareRequestDto as application/*+json, application/json, text/json

Responses

200Field share suspended. — FieldShareDto

400Invalid request, or the share is not Active. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User is not the sharer. — ProblemDetails

404Field share not found. — ProblemDetails

GET/api/v1/shared-with-me

List fields shared with me

Retrieves active field shares where the current user is the recipient, paginated.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`pageNumber`	query	`integer (int32)`	no	—
`pageSize`	query	`integer (int32)`	no	—

Request body

No request body.

Responses

200Shared fields retrieved successfully. — SharedWithMeFieldShareDtoPagedResultDto

400Invalid pagination parameters. — ProblemDetails

401User is not authenticated. — ProblemDetails

Field Subscriptions

GET/api/v1/field-subscriptions

List field subscriptions

Retrieves field subscriptions matching the provided filters. Supply documentId + fieldId to list all subscribers for a specific field, documentId alone for all active subscriptions on a document, or subscriberId for all subscriptions held by a specific subscriber. The subscriber-filtered listing is paged (pageNumber/pageSize; pageSize capped server-side at 100).

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`documentId`	query	`string (uuid)`	no	—
`fieldId`	query	`string`	no	—
`subscriberId`	query	`string (uuid)`	no	—
`pageNumber`	query	`integer (int32)`	no	—
`pageSize`	query	`integer (int32)`	no	—

Request body

No request body.

Responses

200Field subscriptions retrieved successfully. — FieldSubscriptionDto[]

401User is not authenticated. — ProblemDetails

POST/api/v1/field-subscriptions

Create a field subscription

Creates a subscription that delivers synced updates to the subscriber whenever the specified field changes. SyncType controls delivery: Unlimited (always), DateBounded (within a date range), CountLimited (up to MaxSyncs deliveries), or PerSyncConsent (each sync requires explicit approval).

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

CreateFieldSubscriptionCommand as application/*+json, application/json, text/json

Responses

201Field subscription created successfully. — FieldSubscriptionDto

400Invalid request data. — ProblemDetails

401User is not authenticated. — ProblemDetails

404The referenced document was not found. — ProblemDetails

409An active subscription already exists for this field/subscriber combination. — ProblemDetails

POST/api/v1/field-subscriptions/sync

Sync a changed field to its subscribers

Invoked by the field owner's client AFTER the changed field's encrypted value has been written (FR-02.032 ordering). Delivers the supplied per-subscriber re-encrypted envelope to every deliverable subscriber, records the sync against each subscription's allowance/lifecycle, and writes the Rule 29 subscriber-access audit record. Paused, out-of-window, per-sync-consent-denied and envelope-less subscriptions are suppressed. Zero-knowledge: wrapped keys and the value hash are opaque.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

SyncSubscribedFieldRequestDto as application/*+json, application/json, text/json

Responses

200Fan-out complete; returns delivered/suppressed/exhausted counts. — SubscriptionSyncResult

400Invalid request data. — ProblemDetails

401User is not authenticated. — ProblemDetails

403Caller is not the vault owner of the document. — ProblemDetails

404The referenced document was not found. — ProblemDetails

DELETE/api/v1/field-subscriptions/{id}

Cancel a field subscription

Cancels a field subscription, stopping future synced updates from being delivered.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

204Field subscription cancelled successfully.

401User is not authenticated. — ProblemDetails

403User is not the subscriber. — ProblemDetails

404Field subscription not found. — ProblemDetails

409The subscription is already cancelled, expired, or exhausted. — ProblemDetails

Held-Subjects

GET/api/v1/held-subjects

List the animals you hold

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200The animals the caller holds, by name. — HeldSubjectDto[]

401Unauthorized — ProblemDetails

POST/api/v1/held-subjects

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

RegisterHeldSubjectRequest as application/*+json, application/json, text/json

Responses

201The animal, with its server-minted id. — HeldSubjectDto

400Missing name, unknown kind, or a value too long. — ProblemDetails

401Unauthorized — ProblemDetails

GET/api/v1/held-subjects/{id}

Get an animal you hold

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The animal. — HeldSubjectDto

401Unauthorized — ProblemDetails

404No animal with that id is held by the caller. — ProblemDetails

Household Contact Vault

POST/api/v1/household/address-book/containers

Provision a household contact-vault container

Opens the co-owned, client-encrypted container the shared address book anchors to. Idempotent per household.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

ProvisionHouseholdContainerRequestDto as application/*+json, application/json, text/json

Responses

201Container provisioned. — HouseholdContactVaultContainerDto

400Invalid request. — ProblemDetails

401Caller is not authenticated. — ProblemDetails

403Caller is not a participant of the existing container. — ProblemDetails

503Entitlement/quota authority unavailable (fail-closed).

GET/api/v1/household/address-book/{householdId}/contacts

List pooled household contacts

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`householdId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The pooled contacts. — HouseholdContactVaultEntryDto[]

401Caller is not authenticated. — ProblemDetails

403Caller is not a participant of this container. — ProblemDetails

POST/api/v1/household/address-book/{householdId}/contacts

Pool a contact into the shared household book

Stores a per-contributor AES-256-GCM ciphertext envelope in the household container. Zero-knowledge — sealed on the contributor's device.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`householdId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

PoolHouseholdContactRequestDto as application/*+json, application/json, text/json

Responses

201Contact pooled. — HouseholdContactVaultEntryDto

400Invalid request. — ProblemDetails

401Caller is not authenticated. — ProblemDetails

403Caller is not a participant of this container. — ProblemDetails

404No container exists for this household yet. — ProblemDetails

409The container is closed. — ProblemDetails

503Entitlement/quota authority unavailable (fail-closed).

GET/api/v1/household/address-book/{householdId}/container

Get a household contact-vault container

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`householdId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The container. — HouseholdContactVaultContainerDto

401Caller is not authenticated. — ProblemDetails

403Caller is not a participant of this container. — ProblemDetails

404No container exists for this household yet. — ProblemDetails

Keeper-Change

GET/api/v1/keeper-changes

My rehoming standing (sent + awaiting my decision)

The new keeper had no way to find out they had been asked: nothing consumed the initiation event, so no notification was raised, and the acceptance surface was reachable only from a link. A handover whose email was lost or filtered was therefore undiscoverable forever, while the sender polled "pending acceptance" indefinitely. Email-invited handovers are deliberately excluded — those are decided through the token that proves control of the invited address, never through a session.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200The caller's rehoming standing. — KeeperChangeStandingDto

401Unauthorized — ProblemDetails

POST/api/v1/keeper-changes

Initiate a keeper change

Creates a pending-acceptance handover of the subject's record sets to a new keeper.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

InitiateKeeperChangeRequest as application/*+json, application/json, text/json

Responses

201Keeper change created (pending the new keeper's acceptance). — KeeperChangeDto

400Invalid request (missing subject, new keeper handle, or record sets). — ProblemDetails

401User is not authenticated. — ProblemDetails

GET/api/v1/keeper-changes/inbox

List handovers awaiting my decision

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200Handovers awaiting the caller's decision. — KeeperChangeDto[]

401Unauthorized — ProblemDetails

GET/api/v1/keeper-changes/policy

Get the keeper-change handover policy

Static per deployment and carries no user data, so it is cacheable and needs no resource authorization beyond being signed in. It exists so the figures a keeper is shown BEFORE they authorise are the same ones the aggregate binds AFTER they do.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200The handover policy. — KeeperChangePolicyDto

401Unauthorized — ProblemDetails

GET/api/v1/keeper-changes/{id}

Get a keeper change

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The keeper change. — KeeperChangeDto

404No keeper change with that id is visible to the caller. — ProblemDetails

POST/api/v1/keeper-changes/{id}/accept

Accept a keeper change

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The accepted keeper change. — KeeperChangeDto

403The prior keeper cannot accept their own handover, or it is an email invite. — ProblemDetails

404No keeper change with that id. — ProblemDetails

409The handover has already been accepted, declined or cancelled. — ProblemDetails

POST/api/v1/keeper-changes/{id}/decline

Decline a keeper change

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The declined keeper change. — KeeperChangeDto

403The prior keeper cannot decline their own handover, or it is an email invite. — ProblemDetails

404No keeper change with that id. — ProblemDetails

409The handover has already been accepted, declined or cancelled. — ProblemDetails

POST/api/v1/keeper-changes/{id}/invite/accept

Accept a keeper change from an emailed invite

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

KeeperChangeInviteRequest as application/*+json, application/json, text/json

Responses

200The accepted keeper change. — KeeperChangeDto

404The invite did not verify (uniform response). — ProblemDetails

POST/api/v1/keeper-changes/{id}/invite/decline

Decline a keeper change from an emailed invite

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

KeeperChangeInviteRequest as application/*+json, application/json, text/json

Responses

200The declined keeper change. — KeeperChangeDto

404The invite did not verify (uniform response). — ProblemDetails

POST/api/v1/keeper-changes/{id}/invite/verify

Verify an emailed keeper-change invite

Proves control of the invited address before the handover is described. Answers a uniform 404 for an unknown handover, a wrong token, a wrong address or an expired invite.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

KeeperChangeInviteRequest as application/*+json, application/json, text/json

Responses

200The invite verified; the keeper change is returned. — KeeperChangeDto

404The invite did not verify (uniform response — reason is never disclosed). — ProblemDetails

GET/api/v1/keeper-changes/{id}/receipt

Get the handover receipt

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The handover receipt. — HandoverReceiptDto

404No accepted keeper change with that id is visible to the caller. — ProblemDetails

POST/api/v1/keeper-changes/{id}/withdraw

Withdraw a pending keeper change

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The withdrawn keeper change. — KeeperChangeDto

404No pending keeper change with that id belongs to the caller. — ProblemDetails

409The handover has already been decided and can no longer be withdrawn. — ProblemDetails

MediatedAccess

POST/api/v1/vault/mediated-access/descriptors

Enumerates the subject's credential descriptors — refs, types and claim NAMES only, never a body or a value (FR-PMD.003).

POST, not GET, despite being a read. The decision proof is a bearer secret the store compares constant-time, and a query string is written down everywhere a request goes — access logs, proxy logs, traces, `Referer` headers. Carrying it in the body keeps it out of all of them. Since the reference became subject-scoped a leaked proof authorises that subject's credentials specifically, so it is worth more than it was.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`X-Api-Version`	header	`string`	no	—

Request body

Not marked as required in the document.

MediatedDescriptorsRequestDto as application/*+json, application/json, text/json

Responses

200OK — MediatedCredentialDescriptorDto[]

401Unauthorized — ProblemDetails

403Forbidden — ProblemDetails

404Not Found — ProblemDetails

POST/api/v1/vault/mediated-access/open

Opens exactly one credential body under a decision reference. The payload is the client-sealed ciphertext — the server never held the plaintext (zero-knowledge).

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`X-Api-Version`	header	`string`	no	—

Request body

Not marked as required in the document.

OpenMediatedCredentialRequestDto as application/*+json, application/json, text/json

Responses

200OK — MediatedCredentialBodyDto

401Unauthorized — ProblemDetails

403Forbidden — ProblemDetails

404Not Found — ProblemDetails

POST/api/v1/vault/mediated-access/signing

Requests on-device signing. The vault store has no device channel, so the honest answer is always a non-dispatched result the mediator maps to a typed refusal (FR-PMD.006) — but the decision reference is still validated first.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`X-Api-Version`	header	`string`	no	—

Request body

Not marked as required in the document.

MediatedSigningRequestDto as application/*+json, application/json, text/json

Responses

200OK — MediatedSigningDispatchDto

401Unauthorized — ProblemDetails

403Forbidden — ProblemDetails

404Not Found — ProblemDetails

MinorTransitions

POST/api/v1/family/wards/{childId}/accept-ownership

Accept ward vault ownership (UMK re-wrap)

The now-adult records their client-side UMK re-wrap, revoking any residual guardian access and confirming sole key-custody.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`childId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

AcceptWardOwnershipRequestDto as application/*+json, application/json, text/json

Responses

200Ownership accepted; sole key-custody confirmed. — WardOwnershipAcceptedDto

400The request failed validation (e.g. missing key-custody reference). — ProblemDetails

403The caller is not the young adult the vault was rebound to. — ProblemDetails

404No completed majority handover exists for this ward. — ProblemDetails

409Ownership was already accepted with a different key-custody reference (write-once). — ProblemDetails

GET/api/v1/family/wards/{childId}/handover-certificate

Majority handover certificate

Majority date, jurisdiction, revocation timestamp, records transferred, sole-key-custody and a verifiable code.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`childId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The handover certificate. — HandoverCertificateDto

404No handover has completed for this ward. — ProblemDetails

GET/api/v1/family/wards/{childId}/handover-confirmation

Verified-majority handover confirmation

Guardian-access-revocation date + the full former-guardian feed proving zero guardians remain.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`childId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The handover confirmation. — HandoverConfirmationDto

404No handover has completed for this ward. — ProblemDetails

GET/api/v1/family/wards/{childId}/residual-visibility

Per-category residual-guardian visibility

For each record category, whether a former guardian retains a view vs it is private to the young adult.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`childId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The residual-visibility projection. — ResidualVisibilityDto

404No handover has completed for this ward. — ProblemDetails

GET/api/v1/family/wards/{childId}/revocation-proof

Verified-majority revocation proof

Ownership rebound + every guardian's access ended, with the transition reference the audit chain anchors.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`childId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The revocation proof. — RevocationProofDto

404No handover has completed for this ward. — ProblemDetails

GET/api/v1/family/wards/{childId}/transition-prep

Ward vault content-group summary

Live content groups (categories + counts) for the ward vault plus whether the handover has completed.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`childId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The content-group summary. — TransitionPrepDto

404The ward owns no vault. — ProblemDetails

POST/api/v1/wards/{childId}/accept-ownership

Accept ward vault ownership (UMK re-wrap)

The now-adult records their client-side UMK re-wrap, revoking any residual guardian access and confirming sole key-custody.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`childId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

AcceptWardOwnershipRequestDto as application/*+json, application/json, text/json

Responses

200Ownership accepted; sole key-custody confirmed. — WardOwnershipAcceptedDto

400The request failed validation (e.g. missing key-custody reference). — ProblemDetails

403The caller is not the young adult the vault was rebound to. — ProblemDetails

404No completed majority handover exists for this ward. — ProblemDetails

409Ownership was already accepted with a different key-custody reference (write-once). — ProblemDetails

GET/api/v1/wards/{childId}/handover-certificate

Majority handover certificate

Majority date, jurisdiction, revocation timestamp, records transferred, sole-key-custody and a verifiable code.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`childId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The handover certificate. — HandoverCertificateDto

404No handover has completed for this ward. — ProblemDetails

GET/api/v1/wards/{childId}/handover-confirmation

Verified-majority handover confirmation

Guardian-access-revocation date + the full former-guardian feed proving zero guardians remain.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`childId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The handover confirmation. — HandoverConfirmationDto

404No handover has completed for this ward. — ProblemDetails

GET/api/v1/wards/{childId}/residual-visibility

Per-category residual-guardian visibility

For each record category, whether a former guardian retains a view vs it is private to the young adult.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`childId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The residual-visibility projection. — ResidualVisibilityDto

404No handover has completed for this ward. — ProblemDetails

GET/api/v1/wards/{childId}/revocation-proof

Verified-majority revocation proof

Ownership rebound + every guardian's access ended, with the transition reference the audit chain anchors.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`childId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The revocation proof. — RevocationProofDto

404No handover has completed for this ward. — ProblemDetails

GET/api/v1/wards/{childId}/transition-prep

Ward vault content-group summary

Live content groups (categories + counts) for the ward vault plus whether the handover has completed.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`childId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The content-group summary. — TransitionPrepDto

404The ward owns no vault. — ProblemDetails

ModuleExports

POST/api/v1/organizations/{organizationId}/module-exports

Measure the records a module holds for the organisation

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The organisation.

Request body

Not marked as required in the document.

MeasureModuleRecordExportRequestDto as application/*+json, application/json, text/json

Responses

201The recorded export: counts, digest, and the records the caller can move. — ModuleRecordExportDto

400No module, or no or malformed schema ids. — ProblemDetails

404The caller is not an active key-holder of the organisation. — ProblemDetails

422The module holds more records than one export can hold. — ProblemDetails

GET/api/v1/organizations/{organizationId}/module-exports/{exportId}

A recorded export: the stored counts and digest, never re-measured.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The organisation.
`exportId`	path	`string (uuid)`	yes	The export.

Request body

No request body.

Responses

200The export. — ModuleRecordExportDto

404No such export for this organisation, or the caller is not an active key-holder. — ProblemDetails

GET/api/v1/organizations/{organizationId}/module-exports/{exportId}/items

One keyset page of the records the export lists. Metadata only.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The organisation.
`exportId`	path	`string (uuid)`	yes	The export.
`cursor`	query	`string`	no	The previous page's `nextCursor`; omit for the first page.
`limit`	query	`integer (int32)`	no	Page size (default 100, at most 500).

Request body

No request body.

Responses

200The page. — ModuleRecordExportItemDtoCursorResult

404No such export for this organisation, or the caller is not an active key-holder. — ProblemDetails

GET/api/v1/organizations/{organizationId}/module-exports/{exportId}/items/{documentId}/content

The stored ciphertext of one record the export lists, for the client-side transform.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The organisation.
`exportId`	path	`string (uuid)`	yes	The export.
`documentId`	path	`string (uuid)`	yes	The record.

Request body

No request body.

Responses

200The ciphertext (Base64). — OrganizationSealedDocumentContentDto

404The export does not list it, it is no longer sealed to the organisation, or the caller is not an active key-holder. — ProblemDetails

Name-Change Reissue

POST/api/v1/vault/name-change/{changeId}/credentials/{credentialId}/reissue

Reissue a credential under the new name

Standard credentials reissue directly; regulated credentials run a KYC re-verification. Binds the deed-poll evidence and an EPIC 4 audit anchor. Owner-only.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`changeId`	path	`string (uuid)`	yes	—
`credentialId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The credential's reissue state. — CredentialReissueDto

401Caller is not authenticated. — ProblemDetails

404No cascade exists for this change (or the caller does not own it). — ProblemDetails

409The credential is not part of this cascade. — ProblemDetails

GET/api/v1/vault/name-change/{changeId}/evidence-chain

Get a name change's deed-poll evidence chain

Returns the deed-poll → re-attestation → per-credential-reissue chain, each link citing the deed-poll document id and carrying its EPIC 4 audit anchor. Owner-only.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`changeId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The evidence chain. — EvidenceChainDto

401Caller is not authenticated. — ProblemDetails

404No cascade exists for this change (or the caller does not own it). — ProblemDetails

GET/api/v1/vault/name-change/{changeId}/status

Get a name-change reissue cascade's status

Returns the per-credential reissue feed (state, class, KYC result, evidence, audit anchor) and relying-party coverage. Owner-only.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`changeId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The cascade status. — CascadeStatusDto

401Caller is not authenticated. — ProblemDetails

404No cascade exists for this change (or the caller does not own it). — ProblemDetails

NewbornVaults

GET/api/v1/vaults/newborn/by-vault/{vaultId}

Get the newborn-vault provisioning that produced a vault

The provisioning status and seed manifest for a newborn vault, addressed by the vault.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The provisioning. — NewbornVaultProvisioningDto

404The vault was not provisioned from a maternity finalisation, or the caller is neither the mother nor the newborn — the same status for both. — ProblemDetails

GET/api/v1/vaults/newborn/{episodeId}

Get a newborn-vault provisioning

The provisioning status, seed manifest, verified inherited-share count and audit reference for a finalised maternity episode.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`episodeId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The provisioning. — NewbornVaultProvisioningDto

404No provisioning for that episode, or the caller is neither the mother nor the newborn — the same status for both. — ProblemDetails

POST/api/v1/vaults/newborn/{episodeId}

Provision a newborn's vault from a finalised maternity episode

Creates the newborn's own client-encrypted vault under guardian supervision, with zero shares inherited from the mother's maternity record.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`episodeId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

ProvisionNewbornVaultRequestDto as application/*+json, application/json, text/json

Responses

201The newborn's vault was provisioned. — NewbornVaultProvisioningDto

400The request failed validation. — ProblemDetails

404No finalised maternity episode is available to the caller — deliberately the same status whether the episode does not exist or belongs to somebody else, so the route is not an existence oracle for whether a given person has given birth. — ProblemDetails

409The episode has already provisioned a newborn vault, or the newborn already holds one. — ProblemDetails

503The entitlement service could not be reached; the write fails closed.

PUT/api/v1/vaults/newborn/{episodeId}/seed-records/{sourceRecordId}

Attach a seeded document to a nominated record

Binds the newborn-vault document the client wrote for one nominated maternity record.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`episodeId`	path	`string (uuid)`	yes	—
`sourceRecordId`	path	`string`	yes	—

Request body

Not marked as required in the document.

AttachNewbornSeedRecordRequestDto as application/*+json, application/json, text/json

Responses

200The updated provisioning. — NewbornVaultProvisioningDto

400The request failed validation. — ProblemDetails

404The provisioning is not available to the caller, the source record was not nominated, or the document does not exist in the newborn's own vault. — ProblemDetails

409The vault is not provisioned yet, or the record is already seeded by a different document. — ProblemDetails

OrganizationGrantCertificate

POST/api/v1/organizations/grant-certificates

Redeems a grant certificate, writing the founder grant on this instance.

[Authorize], not anonymous — and the distinction from the enrolment endpoint matters. There, the caller is a machine with no credential and the code is the proof. Here the caller is a PERSON who has already signed in to their own organisation's instance, and the certificate says which person Essence authorised. Both must hold: a valid certificate presented by somebody else must not make THEM the founder, which is checked in the handler against the authenticated subject. Rate-limited: the certificate is a bearer artifact and this endpoint decides who founds an organisation.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`X-Api-Version`	header	`string`	no	—

Request body

Not marked as required in the document.

RedeemGrantCertificateRequest as application/*+json, application/json, text/json

Responses

200The grant is written. The claimant may now provision the keypair. — RedeemGrantCertificateResponse

400The certificate did not verify, or does not name the caller. — ProblemDetails

OrganizationKeyPair

POST/api/v1/organizations/{organizationId}/key-pair

Provisions the organisation keypair from client-generated material (idempotent).

The declared 403 covers both causes deliberately indistinguishably: no founder grant authorises the caller, and the keypair exists but the caller is not one of its key-holders. Separating them would tell an attacker probing organisation ids which orgs are unclaimed.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

ProvisionOrganizationKeyPairRequest as application/*+json, application/json, text/json

Responses

200OK — OrganizationKeyPairSummaryDto

403Forbidden — ProblemDetails

GET/api/v1/organizations/{organizationId}/key-pair/holders

Lists the organisation's active key-holder user ids (metadata; used by the rotation flow).

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200OK — OrganizationKeyHoldersDto

404Not Found — ProblemDetails

POST/api/v1/organizations/{organizationId}/key-pair/holders

Adds a key-holder (the authenticated caller must be an existing active holder).

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

AddOrganizationKeyHolderRequest as application/*+json, application/json, text/json

Responses

200OK — OrganizationKeyPairSummaryDto

403Forbidden — ProblemDetails

404Not Found — ProblemDetails

409Conflict — ProblemDetails

GET/api/v1/organizations/{organizationId}/key-pair/holders/me

Returns the calling key-holder's own wrapped copy of the org private key (read-as-org).

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200OK — OrganizationKeyHolderEnvelopeDto

404Not Found — ProblemDetails

DELETE/api/v1/organizations/{organizationId}/key-pair/holders/{holderUserId}

Revokes a key-holder (refuses the last active holder — rotate first).

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	—
`holderUserId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200OK — OrganizationKeyPairSummaryDto

403Forbidden — ProblemDetails

404Not Found — ProblemDetails

409Conflict — ProblemDetails

POST/api/v1/organizations/{organizationId}/key-pair/master-key

Enrols an Organisation Master Key on an organisation provisioned before they existed (#4710).

The one-time backfill. The caller — an existing ACTIVE key-holder — generates the key client-side and supplies it wrapped to every active holder's public key in this request. The server never sees the plaintext key and cannot mint one, which is why this is a client-initiated backfill rather than a data migration.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

EnrolOrganizationMasterKeyRequest as application/*+json, application/json, text/json

Responses

200OK — OrganizationKeyPairSummaryDto

403Forbidden — ProblemDetails

404Not Found — ProblemDetails

409Conflict — ProblemDetails

POST/api/v1/organizations/{organizationId}/key-pair/rotate

Rotates the org keypair (revoke-and-rotate): new keypair re-sealed to the remaining holders.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

RotateOrganizationKeyPairRequest as application/*+json, application/json, text/json

Responses

200OK — OrganizationKeyPairSummaryDto

400Bad Request — ProblemDetails

403Forbidden — ProblemDetails

404Not Found — ProblemDetails

409Conflict — ProblemDetails

OrganizationKeyRecovery

GET/api/v1/organizations/{organizationId}/key-pair/recovery

Whether the organisation has a current recovery kit. Never returns key material.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The status. Enrolment and claim provenance are filled for key-holders only. — OrganizationRecoveryKitStatusDto

404The organisation has no keypair. — ProblemDetails

PUT/api/v1/organizations/{organizationId}/key-pair/recovery

Enrols or replaces the recovery kit (the caller must be an active key-holder).

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

EnrolOrganizationRecoveryKitRequest as application/*+json, application/json, text/json

Responses

200Enrolled. Any previous kit stops working. — OrganizationRecoveryKitStatusDto

400An envelope or scheme is missing, or the verifier is shorter than 32 bytes. — ProblemDetails

403The caller is not an active key-holder. — ProblemDetails

404The organisation has no keypair. — ProblemDetails

409The keypair is not Active, or the organisation holds a master key and none was wrapped. — ProblemDetails

DELETE/api/v1/organizations/{organizationId}/key-pair/recovery

Withdraws the recovery kit (the caller must be an active key-holder). Idempotent.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200Withdrawn, or there was none. — OrganizationRecoveryKitStatusDto

403The caller is not an active key-holder. — ProblemDetails

404The organisation has no keypair. — ProblemDetails

409Conflict — ProblemDetails

POST/api/v1/organizations/{organizationId}/key-pair/recovery/claim

The caller becomes an active key-holder through the kit — no incumbent holder is needed.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

ClaimOrganizationKeyHolderByRecoveryKitRequest as application/*+json, application/json, text/json

Responses

200The caller is a key-holder (already was, or now is). — OrganizationKeyPairSummaryDto

400The verifier or the re-wrapped envelope is missing. — ProblemDetails

403The verifier does not match the organisation's kit. — ProblemDetails

404The organisation has no keypair. — ProblemDetails

409No current kit, the keypair is not Active, or the master-key envelope is missing. — ProblemDetails

429Too Many Requests — ProblemDetails

POST/api/v1/organizations/{organizationId}/key-pair/recovery/unlock

Proves possession of the kit and returns its opaque envelopes, for the client to unwrap.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

UnlockOrganizationRecoveryKitRequest as application/*+json, application/json, text/json

Responses

200The envelopes (ciphertext only; the server cannot open them). — OrganizationRecoveryKitEnvelopeDto

400The verifier is missing. — ProblemDetails

403The verifier does not match the organisation's kit. — ProblemDetails

404The organisation has no keypair. — ProblemDetails

409The organisation has no current kit. — ProblemDetails

429Too Many Requests — ProblemDetails

OrganizationKeyRotation

GET/api/v1/organizations/{organizationId}/key-pair/rotation/documents

One keyset page of the documents sealed to the organisation's key, across ALL of its organisation vaults. Metadata only.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The organisation.
`cursor`	query	`string`	no	The previous page's `nextCursor`; omit for the first page.
`limit`	query	`integer (int32)`	no	Page size (default 100, at most 200).

Request body

No request body.

Responses

200The page. — OrganizationSealedDocumentDtoCursorResult

404The caller is not an active key-holder, or the organisation has no keypair. — ProblemDetails

GET/api/v1/organizations/{organizationId}/key-pair/rotation/documents/{documentId}/content

The stored ciphertext of one organisation-sealed document, to re-wrap.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The organisation.
`documentId`	path	`string (uuid)`	yes	The document.

Request body

No request body.

Responses

200The ciphertext (Base64). — OrganizationSealedDocumentContentDto

404Absent, not sealed to this organisation's key, or the caller is not an active key-holder. — ProblemDetails

PUT/api/v1/organizations/{organizationId}/key-pair/rotation/documents/{documentId}/content

Write back one organisation-sealed document re-wrapped to the organisation's CURRENT key, as a new version.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	The organisation.
`documentId`	path	`string (uuid)`	yes	The document.

Request body

Not marked as required in the document.

RewrapOrganizationSealedDocumentRequestDto as application/*+json, application/json, text/json

Responses

200Re-wrapped; the prior bytes are kept as a restorable version. — DocumentDto

400The body is malformed. — ProblemDetails

404Absent, not sealed to this organisation's key, or the caller is not an active key-holder. — ProblemDetails

422The key id is not the organisation's current key, the document is already on it, or the envelope length changed. — ProblemDetails

OrganizationPublicKey

GET/api/v1/organizations/{organizationId}/public-key

Serves the organisation's published public key (the grantor wrap target).

404 covers "no keypair" and "you have no relationship with this organisation" identically. 503 means the relationship could not be checked, never that the key is absent.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200OK — OrganizationPublicKeyDto

404Not Found — ProblemDetails

503Service Unavailable

OrganizationVaultStatistics

GET/api/v1/organizations/{organizationId}/vault-statistics/vault-count

How many active vaults this organisation holds.

Answers 404 rather than 403 on a tenancy mismatch, so one organisation's existence cannot be probed from another's token — the same rule the platform's other org-scoped reads hold. A platform admin may ask about any organisation.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`organizationId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200OK — OrganizationVaultCountDto

404Not Found — ProblemDetails

RectificationNotices

GET/api/v1/vaults/rectification-notices

The caller's rectification tasks on this instance.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`includeCompleted`	query	`boolean`	no	Also return completed tasks.

Request body

No request body.

Responses

200OK — RectificationNoticeDto[]

401Unauthorized — ProblemDetails

POST/api/v1/vaults/rectification-notices/{id}/complete

The caller's client reports a correction applied: the record re-encrypted, and re-shared with any Art.19 recipients. Idempotent.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The notice.

Request body

No request body.

Responses

200OK — RectificationNoticeDto

401Unauthorized — ProblemDetails

404Not Found — ProblemDetails

Returning-National Reconciliation

GET/api/v1/vaults/returning-national/reconciliation/disputes

List open returning-national reconciliation disputes (operator queue)

Identifiers, stage, reason code, the user's own narrative and the disposition counts at stake — never vault content.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`limit`	query	`integer (int32)`	no	—

Request body

No request body.

Responses

200The open-dispute queue. — ReconciliationDisputeQueueItemDto[]

401Caller is not authenticated. — ProblemDetails

403Caller does not hold the dispute-reviewer role. — ProblemDetails

GET/api/v1/vaults/returning-national/{intakeId}/reconciliation

Get a returning-national reconciliation

Replays the match decision and per-item disposition (and, once confirmed, the disposition log). Scoped to the owning user.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`intakeId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The reconciliation. — ReturningNationalReconciliationDto

401Caller is not authenticated. — ProblemDetails

404No reconciliation for this intake owned by the caller. — ProblemDetails

POST/api/v1/vaults/returning-national/{intakeId}/reconciliation

Prepare a returning-national reconciliation proposal

Computes the per-item disposition (carry-over / already-here-by-content-hash / stays-in-origin-by-residency-lock) from the client-submitted candidate manifest. Zero-knowledge — content hashes + classifications only.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`intakeId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

PrepareReconciliationRequestDto as application/*+json, application/json, text/json

Responses

201Reconciliation proposal prepared. — ReturningNationalReconciliationDto

400Invalid request. — ProblemDetails

401Caller is not authenticated. — ProblemDetails

409A reconciliation already exists for this intake. — ProblemDetails

503Entitlement/quota authority unavailable (fail-closed).

POST/api/v1/vaults/returning-national/{intakeId}/reconciliation/confirm

Confirm a returning-national reconciliation merge

Finalises the merge under explicit consent: provisions the home vault, records the disposition log (carried / deduplicated / left-behind) and chains to the EPIC 9 bootstrap decision for the EPIC 4/12 audit anchor.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`intakeId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

ConfirmReconciliationRequestDto as application/*+json, application/json, text/json

Responses

200Reconciliation confirmed. — ReturningNationalReconciliationDto

400Invalid request. — ProblemDetails

401Caller is not authenticated. — ProblemDetails

404No reconciliation for this intake owned by the caller. — ProblemDetails

409Consent absent, or already confirmed. — ProblemDetails

503Entitlement/quota authority unavailable (fail-closed).

POST/api/v1/vaults/returning-national/{intakeId}/reconciliation/dispute

Raise a dispute against a returning-national reconciliation

'This isn't my vault'. A before-merge dispute halts the merge and queues the case for review; an after-merge dispute opens a reversal review inside the operator's stated window. Zero-knowledge — a reason code plus the user's own free text.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`intakeId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

RaiseReconciliationDisputeRequestDto as application/*+json, application/json, text/json

Responses

201Dispute recorded. — ReconciliationDisputeDto

400Invalid request. — ProblemDetails

401Caller is not authenticated. — ProblemDetails

404No reconciliation for this intake owned by the caller. — ProblemDetails

409Dispute already open, wrong stage for the current state, or window closed. — ProblemDetails

POST/api/v1/vaults/returning-national/{intakeId}/reconciliation/dispute/disposition

Dispose of a returning-national reconciliation dispute (operator)

Uphold / reverse / decline. A reversal writes a compensating disposition log chained to the original confirmation rather than deleting it.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`intakeId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

DisposeReconciliationDisputeRequestDto as application/*+json, application/json, text/json

Responses

200Disposition recorded. — ReconciliationDisputeDto

400Invalid request. — ProblemDetails

401Caller is not authenticated. — ProblemDetails

403Caller does not hold the dispute-reviewer role. — ProblemDetails

404No reconciliation for this intake. — ProblemDetails

409No such open dispute, or inadmissible disposition for its stage. — ProblemDetails

Search

GET/api/v1/Search/suggestions

Get search suggestions for autocomplete

Returns search suggestions based on partial input by searching document filenames, category names, and tags in Elasticsearch. Supports fuzzy matching for typo tolerance. Only returns suggestions from documents in vaults owned by the authenticated user.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	query	`string (uuid)`	no	Vault ID to scope suggestions to a specific vault.
`input`	query	`string`	no	Partial search input for autocomplete (minimum 2 characters).
`maxSuggestions`	query	`integer (int32)`	no	Maximum number of suggestions to return (default: 10, max: 50).

Request body

No request body.

Responses

200Search suggestions retrieved successfully. — string[]

400Invalid request parameters. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not own the vault. — ProblemDetails

Self-Exclusion

POST/api/v1/self-exclusion

Create a self-exclusion

Creates an immediately-active, time-bound self-exclusion. Requires the explicit hard-commitment confirmation.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

CreateSelfExclusionRequest as application/*+json, application/json, text/json

Responses

201Self-exclusion created (or the already-active exclusion returned). — SelfExclusionDto

400Invalid request (missing confirmation, out-of-range duration, or missing jurisdiction). — ProblemDetails

401User is not authenticated. — ProblemDetails

GET/api/v1/self-exclusion/current

Get current self-exclusion

Returns the user's active self-exclusion, or 204 No Content when the user has no active exclusion.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200The user's active self-exclusion. — SelfExclusionDto

204The user has no active self-exclusion.

401User is not authenticated. — ProblemDetails

SharedBlobs

POST/api/v1/shared-blobs

Uploads a client-encrypted shared blob and returns its absolute capability URI.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

object as multipart/form-data

Responses

201Created — SharedBlobCreatedDto

GET/api/v1/shared-blobs/{token}

Retrieves a shared blob's ciphertext by its capability token (anonymous + rate-limited).

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`token`	path	`string`	yes	—

Request body

No request body.

Responses

200OK

404Not Found — ProblemDetails

DELETE/api/v1/shared-blobs/{token}

Destroys a shared blob's ciphertext by its capability token. Service-to-service only.

This is the purge counterpart of M:Essence.Core.Vault.Api.Controllers.SharedBlobsController.Create(Microsoft.AspNetCore.Http.IFormFile,System.String,System.Nullable{System.DateTime},System.Threading.CancellationToken) (debt-2026-08-27-182). Until it existed, every consumer that had to "purge" a shared payload could only drop its reference: EPIC 6's revocation and EPIC 89's issuance purge transitions both made the bytes UNREACHABLE while leaving them on disk. Under a retention obligation those are different facts, and only this route makes the second one true. Why the ServiceProvisioning scheme and not the capability token. The GET below is deliberately anonymous because possession of the token yields only ciphertext — the content is E2E-encrypted, so a leaked URI discloses nothing. That argument does not extend to destruction. The GRANTEE also holds the token, so a token-authorised DELETE would let a recipient destroy the grantor's shared payload, and an intercepted URI would buy an attacker deletion rather than unreadable bytes. Nor can this be the ordinary user scheme: the callers are background purge paths (EPIC 89's hold-expiry reaper, EPIC 6's revocation) that run long after the session that created the blob has gone. So it takes the same separately-signed service credential the cross-instance provision/erase endpoints use, which the default user scheme rejects and which is unusable on an instance that configures no service secret. Scoped, and the scope is checked. That scheme also guards cross-instance vault provision and erase, so naming the scheme alone would hand every shared-blob purger authority to erase entire vaults (debt-2026-08-27-213). The policy below additionally requires `scope=vault:shared-blob:delete` — the value the purge callers already mint — so a credential issued for this route reaches only this route, and one issued elsewhere is refused here with a 403. Idempotent. An unknown, malformed, already-purged or expired token all return 204. A purge reaper retries, and a retry after a partial failure must not read as an error; the uniform response also denies a caller any existence oracle over the token space.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`token`	path	`string`	yes	—

Request body

No request body.

Responses

204No Content

POST/api/v1/shared-blobs/{token}/withdraw

Withdraws a shared blob its creator uploaded for a grant that was never recorded (#10262).

A share uploads the ciphertext before the grant, because the grant carries the URI. When the grant is refused, this is how the grantor's session takes the capability back, so a refused share leaves nothing that answers to its URI and no consent record governs. Authorised by the signed-in user being the blob's CREATOR — never by the token, which the grantee also holds (the reason the purge M:Essence.Core.Vault.Api.Controllers.SharedBlobsController.Delete(System.String,System.Threading.CancellationToken) above is service-only). Idempotent: an unknown, malformed or already-withdrawn token returns 204; someone else's blob returns 403.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`token`	path	`string`	yes	—

Request body

No request body.

Responses

204No Content

403Forbidden — ProblemDetails

Stolen Wallet

GET/api/v1/vault/wallet-credentials

List wallet credentials

Returns the credentials the vault references as held in the user's physical wallet, for the stolen-wallet reissue journey.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	query	`string (uuid)`	no	Vault to list wallet credentials for (must be owned by the caller).

Request body

No request body.

Responses

200Wallet credentials for the vault. — WalletCredentialDto[]

400The vaultId query parameter is missing or empty. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Vault not found or not owned by the caller. — ProblemDetails

POST/api/v1/vault/wallet-reissue/fan-out

Fan out wallet credential reissue

Emits per-credential reissue requests (and, when consented, mark-compromised requests) for the selected wallet credentials. Idempotent by IdempotencyKey.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

WalletReissueFanOutCommand as application/*+json, application/json, text/json

Responses

200Per-credential fan-out outcomes. — WalletReissueFanOutResultDto

400Invalid request data. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Vault not found or not owned by the caller. — ProblemDetails

Subject Export

GET/api/v1/subject-export/scope

Measure the subject's export scope

Returns the record count and estimated payload for each Art.15 category this service sources, without materialising any of it. The counts are produced by the same predicate the collect endpoint applies, so a manifest built from them cannot disagree with the bundle that follows.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200Scope measured. — SubjectExportScopeDto

401Caller is not authenticated. — ProblemDetails

GET/api/v1/subject-export/{category}

Collect a page of the subject's export category

Returns one page of the requested category as machine-readable JSON, ordered oldest-first by a total order so repeated paging can neither drop nor duplicate a record. Content is not disclosed: the platform stores it client-side encrypted and cannot read it, which the response states in plain language.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`category`	path	`string`	yes	`documents` or `field-metadata`.
`skip`	query	`integer (int32)`	no	Records to skip. Defaults to 0.
`take`	query	`integer (int32)`	no	Page size. Defaults to 100, capped at 200.

Request body

No request body.

Responses

200Page returned. — SubjectExportPageDto

400Unknown category, or paging parameters out of range. — ProblemDetails

401Caller is not authenticated. — ProblemDetails

SupervisedVaults

POST/api/v1/vaults/supervised

Seed a supervised (minor) vault

Places the minor's vault under guardian supervision bound to a graduation schedule, with the initial per-guardian role set.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

SeedSupervisedVaultRequestDto as application/*+json, application/json, text/json

Responses

201The supervised vault was seeded. — SupervisedVaultDto

400The request failed validation. — ProblemDetails

403The caller is not among the guardians they are assigning, or no active identity guardianship for the minor names the caller as a guardian (debt-2026-08-13-203). — ProblemDetails

404The target vault does not exist. — ProblemDetails

409The vault is already supervised, or is not owned by the minor. — ProblemDetails

503The identity service could not be consulted to corroborate the guardianship. No supervision was seeded, and this is deliberately NOT reported as a 403 — it says nothing about whether the caller is a guardian. Carries `Retry-After`.

POST/api/v1/vaults/supervised/minor

Provision a minor's supervised vault

Creates the minor's own client-encrypted vault and places it under guardian supervision bound to a graduation schedule, in one unit of work.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

ProvisionMinorVaultRequestDto as application/*+json, application/json, text/json

Responses

201The minor's vault was provisioned and placed under supervision (also returned, unchanged, for a repeat of the same request). — SupervisedVaultDto

400The request failed validation. — ProblemDetails

403The caller is not among the guardians they are assigning, or no active identity guardianship for the minor names the caller as a guardian. — ProblemDetails

409The minor already has a vault; supervise that one rather than creating a second. — ProblemDetails

503The identity service could not be consulted to corroborate the guardianship. Nothing was provisioned, and this is deliberately NOT reported as a 403 — it says nothing about whether the caller is a guardian. Carries `Retry-After`.

GET/api/v1/vaults/supervised/proxy-exclusions

List the caller's confidential elections (subject only)

What the caller has withheld, and from whom — their own record of the decision. Never visible to a guardian.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200The caller's elections (empty when they have made none). — ProxyExclusionDto[]

401The caller is not authenticated. — ProblemDetails

404The caller is the subject of no supervised vault. — ProblemDetails

PUT/api/v1/vaults/supervised/proxy-exclusions/{itemRef}

Withhold an item from a guardian's proxy (subject only)

Records the caller's confidential election over one item in their own supervised vault.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`itemRef`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

ElectProxyExclusionRequestDto as application/*+json, application/json, text/json

Responses

200The election (existing or newly recorded). — ProxyExclusionDto

400The request failed validation. — ProblemDetails

401The caller is not authenticated. — ProblemDetails

404The caller has no supervised vault, or the item is not in it. — ProblemDetails

409The named principal holds no standing proxy over the vault. — ProblemDetails

DELETE/api/v1/vaults/supervised/proxy-exclusions/{itemRef}

Revoke a confidential election (subject only)

Stops withholding one item from a guardian's standing proxy.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`itemRef`	path	`string (uuid)`	yes	—
`guardianActorId`	query	`string (uuid)`	no	—

Request body

No request body.

Responses

204The election was revoked.

400The request failed validation. — ProblemDetails

401The caller is not authenticated. — ProblemDetails

404No such election. — ProblemDetails

GET/api/v1/vaults/supervised/proxy-preview/{guardianActorId}

Preview a guardian's proxy view (subject only)

The rows a named guardian would be served, flagged with the caller's own confidential elections so the preview exercises the real projection.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`guardianActorId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The flagged proxy input for that guardian. — GuardianProxyViewInputDto

401The caller is not authenticated. — ProblemDetails

404The caller is the subject of no supervised vault, or the named principal holds no standing proxy over it — one status for both, so this cannot be used as an oracle. — ProblemDetails

GET/api/v1/vaults/supervised/{vaultId}

Get a supervised vault's provisioning

The graduation schedule, per-guardian role set, and rebind status for a supervised vault.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The supervised-vault provisioning. — SupervisedVaultDto

404The vault is not under supervision, or the caller is not a principal on the provisioning. Deliberately the same status for both, so the route is not an existence oracle for whether a vault belongs to a supervised child. — ProblemDetails

POST/api/v1/vaults/supervised/{vaultId}/custody-transfer

Transfer custody of a supervised vault

Records an evidenceable custody transfer: prior guardians and when their access ended, new custodians and their grant instant, the authoriser and the order reference.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

TransferCustodyRequestDto as application/*+json, application/json, text/json

Responses

201Custody was transferred and the record produced. — CustodyTransferDto

400The request failed validation (a missing order reference lands here). — ProblemDetails

403The caller is on the provisioning but holds a subordinate guardian role; only the provisioning parent or a Full guardian may transfer custody — deliberately the same authority boundary as the guardian-roles route, so this is not a weaker door. — ProblemDetails

404The vault is not under supervision, or the caller is not a principal on the provisioning at all — the same status for both. — ProblemDetails

409The vault has already rebound to the young adult; supervision has ended. — ProblemDetails

GET/api/v1/vaults/supervised/{vaultId}/custody-transfers

List a supervised vault's custody transfers

The vault's chain of custody, most recent first.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The vault's custody history (empty when custody has never transferred). — CustodyTransferDto[]

404The vault is not under supervision, or the caller is party to neither the provisioning nor any of its transfers. — ProblemDetails

GET/api/v1/vaults/supervised/{vaultId}/custody-transfers/{transferId}/certificate

Export a custody-transfer certificate

The custody-transfer record as a self-describing, exportable certificate.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	—
`transferId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The custody-transfer certificate. — CustodyTransferCertificateDto

404The transfer does not exist, does not belong to the routed vault, or is not visible to the caller — one status for all three, so the route cannot be probed. — ProblemDetails

PUT/api/v1/vaults/supervised/{vaultId}/guardian-roles

Set per-guardian roles on a supervised vault

Replaces the per-guardian role set so co-guardians can hold distinct roles (full / contribute / view-only / emergency-only).

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

SetGuardianRolesRequestDto as application/*+json, application/json, text/json

Responses

200The guardian roles were reassigned. — SupervisedVaultDto

400The request failed validation. — ProblemDetails

403The caller is on the provisioning but holds a subordinate guardian role; only the provisioning parent or a Full guardian may reassign the role set (debt-2026-08-13-201). — ProblemDetails

404The vault is not under supervision, or the caller is not a principal on the provisioning at all — the same status for both, so probing this route cannot reveal that a vault belongs to a supervised child. — ProblemDetails

409The vault has already rebound to the young adult; supervision has ended. — ProblemDetails

GET/api/v1/vaults/supervised/{vaultId}/proxy-view

Read a guardian's projected proxy view

The supervised vault as the authenticated guardian sees it, with every aggregate recomputed from the visible set.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The projected view. — GuardianProxyViewDto

401The caller is not authenticated. — ProblemDetails

403The caller holds no proven guardian seat over the vault. — ProblemDetails

404The vault is not under supervision. — ProblemDetails

Templates

GET/api/v1/Templates

List document templates

Retrieves a paginated list of document templates with optional filtering by category and active status.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`pageNumber`	query	`integer (int32)`	no	The page number (default: 1).
`pageSize`	query	`integer (int32)`	no	The page size (default: 20, max: 100).
`category`	query	`string`	no	Filter by category: Identity, Financial, Health, Education, Property (optional).
`isActive`	query	`boolean`	no	Filter by active status (optional).

Request body

No request body.

Responses

200Template list retrieved successfully. — ListTemplatesQueryResult

400Invalid pagination or filter parameters. — ProblemDetails

401User is not authenticated. — ProblemDetails

POST/api/v1/Templates

Create a new template

Creates a new document template with multi-language support and field mappings. Template is active by default.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

CreateTemplateCommand as application/*+json, application/json, text/json

Responses

201Template created successfully. — CreateTemplateCommandResult

400Invalid template data or duplicate name. — ProblemDetails

401User is not authenticated. — ProblemDetails

GET/api/v1/Templates/by-category/{category}

Get templates by category

Retrieves all templates in a specific category (Identity, Financial, Health, Education, Property).

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`category`	path	`string`	yes	The category (Identity, Financial, Health, Education, Property).

Request body

No request body.

Responses

200Templates retrieved successfully. — GetTemplatesByCategoryQueryResult

401User is not authenticated. — ProblemDetails

GET/api/v1/Templates/by-schema/{schemaRef}

Get templates by schema

Retrieves all templates that use a specific document schema.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`schemaRef`	path	`string`	yes	The schema ID.

Request body

No request body.

Responses

200Templates retrieved successfully. — GetTemplatesBySchemaQueryResult

401User is not authenticated. — ProblemDetails

GET/api/v1/Templates/{id}

Get template by ID

Retrieves detailed information about a specific template by ID including all localized content and field mappings.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The template ID.

Request body

No request body.

Responses

200Template retrieved successfully. — TemplateDto

401User is not authenticated. — ProblemDetails

404Template not found. — ProblemDetails

PUT/api/v1/Templates/{id}

Update template

Updates an existing template's details, localized content, and field mappings. Category cannot be changed.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The template ID.

Request body

Not marked as required in the document.

UpdateTemplateCommand as application/*+json, application/json, text/json

Responses

200Template updated successfully. — UpdateTemplateCommandResult

400Invalid template data. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Template not found. — ProblemDetails

DELETE/api/v1/Templates/{id}

Delete template

Deletes a template permanently. Consider using deactivate for soft delete instead.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The template ID.

Request body

No request body.

Responses

204Template deleted successfully.

401User is not authenticated. — ProblemDetails

404Template not found. — ProblemDetails

POST/api/v1/Templates/{id}/activate

Activate template

Activates a template, making it available for document creation.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The template ID.

Request body

No request body.

Responses

200Template activated successfully. — ActivateTemplateCommandResult

400Template is already active. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Template not found. — ProblemDetails

POST/api/v1/Templates/{id}/deactivate

Deactivate template

Deactivates a template, making it unavailable for document creation (soft delete).

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The template ID.

Request body

No request body.

Responses

200Template deactivated successfully. — DeactivateTemplateCommandResult

400Template is already inactive. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Template not found. — ProblemDetails

Uploads

POST/api/v1/Uploads

Initiate chunked file upload

Creates a new upload session for chunked file upload. Performs file validation and duplicate detection. Returns session ID for subsequent chunk uploads.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

InitiateUploadCommand as application/*+json, application/json, text/json

Responses

201Upload session created successfully. — InitiateUploadCommandResult

400Invalid file metadata or validation failure. — ProblemDetails

401User is not authenticated. — ProblemDetails

409File already exists (duplicate detected). — ProblemDetails

428Account recovery must be set up before this vault can grow (graduated trust, D-121). — ProblemDetails

DELETE/api/v1/Uploads/{id}

Cancel file upload

Cancels an active upload session and deletes all uploaded chunks from storage. Idempotent operation - already cancelled sessions are safely ignored.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The upload session ID.

Request body

Not marked as required in the document.

CancelUploadCommand as application/*+json, application/json, text/json

Responses

204Upload session cancelled successfully.

400Upload already completed or invalid state. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Upload session not found. — ProblemDetails

POST/api/v1/Uploads/{id}/chunks

Upload file chunk

Uploads a single chunk for an existing upload session. Performs hash verification and validates chunk index. Idempotent operation - duplicate chunks are safely ignored.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The upload session ID.

Request body

Not marked as required in the document.

UploadChunkCommand as application/*+json, application/json, text/json

Responses

200Chunk uploaded successfully. — UploadChunkCommandResult

400Invalid chunk data, hash mismatch, or session expired. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Upload session not found. — ProblemDetails

POST/api/v1/Uploads/{id}/complete

Complete file upload

Completes an upload session by merging all chunks into a final file. Validates that all chunks have been uploaded. Triggers virus scanning asynchronously.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The upload session ID.

Request body

Not marked as required in the document.

CompleteUploadCommand as application/*+json, application/json, text/json

Responses

200Upload completed successfully. — CompleteUploadCommandResult

400Not all chunks uploaded, or the merged file does not match its declared hash. — ProblemDetails

401User is not authenticated. — ProblemDetails

404Upload session not found. — ProblemDetails

409The session has already ended (quarantined, failed or cancelled). — ProblemDetails

422Malware detected; the upload was quarantined and purged. — ProblemDetails

500The completion failed on the server. — ProblemDetails

GET/api/v1/Uploads/{id}/status

Get upload status

Retrieves the current status and progress information for an upload session. Useful for monitoring upload progress and resuming interrupted uploads.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The upload session ID.

Request body

No request body.

Responses

200Upload status retrieved successfully. — UploadSessionDto

401User is not authenticated. — ProblemDetails

404Upload session not found. — ProblemDetails

Vault Access

GET/api/v1/vaults/{vaultId}/access

List vault collaborators

Retrieves all users with access to the vault. Requires at least Viewer access.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	The ID of the vault.

Request body

No request body.

Responses

200Collaborators retrieved successfully. — VaultAccessDto[]

401User is not authenticated. — ProblemDetails

403User does not have permission to view collaborators. — ProblemDetails

404Vault not found. — ProblemDetails

POST/api/v1/vaults/{vaultId}/access

Grant vault access

Grants access to a user with a specified role (Viewer, Editor, or Owner). Only vault owners can grant access.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	The ID of the vault.

Request body

Not marked as required in the document.

GrantAccessRequest as application/*+json, application/json, text/json

Responses

201Access granted successfully. — VaultAccessDto

400Invalid request data. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User is not the vault owner. — ProblemDetails

404Vault not found. — ProblemDetails

409User already has active access. — ProblemDetails

DELETE/api/v1/vaults/{vaultId}/access/{accessId}

Revoke vault access

Revokes a user's access to the vault. Only vault owners can revoke access. Owners cannot revoke their own access.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	The ID of the vault.
`accessId`	path	`string (uuid)`	yes	The ID of the access record to revoke.

Request body

No request body.

Responses

204Access revoked successfully.

401User is not authenticated. — ProblemDetails

403User is not the vault owner or attempting to revoke own access. — ProblemDetails

404Access record not found. — ProblemDetails

409Revoke rejected: would remove the last controlling Owner of the vault. — ProblemDetails

PUT/api/v1/vaults/{vaultId}/access/{accessId}/role

Update user role

Updates a user's role for the vault. Only vault owners can update roles. Owners cannot change their own role.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`vaultId`	path	`string (uuid)`	yes	The ID of the vault.
`accessId`	path	`string (uuid)`	yes	The ID of the access record to update.

Request body

Not marked as required in the document.

UpdateRoleRequest as application/*+json, application/json, text/json

Responses

200Role updated successfully. — VaultAccessDto

400Invalid request data. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User is not the vault owner or attempting invalid role change. — ProblemDetails

404Access record not found. — ProblemDetails

409Downgrade rejected: would remove the last controlling Owner of the vault. — ProblemDetails

Vault Imports

POST/api/v1/vault/imports

Record an import-batch encrypted-store seal receipt

Attests that an imported batch's records were AES-256-GCM sealed on-device before storage. Zero-knowledge — algorithm label, encrypted-record count and an opaque seal hash only.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

RecordImportSealRequestDto as application/*+json, application/json, text/json

Responses

201Seal receipt recorded. — VaultImportSealReceiptDto

400Invalid request. — ProblemDetails

401Caller is not authenticated. — ProblemDetails

503Entitlement/quota authority unavailable (fail-closed).

GET/api/v1/vault/imports/{id}/encrypted-store-receipt

Get an import-batch encrypted-store seal receipt

Replays the client-attested proof that the imported records were sealed on-device before storage. Scoped to the importing user.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The seal receipt. — VaultImportSealReceiptDto

401Caller is not authenticated. — ProblemDetails

404No receipt for this id owned by the caller. — ProblemDetails

Vault Split Rebind

GET/api/v1/vaults/split-rebinds/{splitId}

Read a partition's ownership-rebind account

Viewer-relative: allocated/rebound/outstanding are resolved against the calling party. Visible only to the two parties to the split.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`splitId`	path	`string`	yes	—

Request body

No request body.

Responses

200The rebind account. — VaultSplitRebindDto

401Caller is not authenticated. — ProblemDetails

404No such split, or the caller is not a party to it. — ProblemDetails

POST/api/v1/vaults/split-rebinds/{splitId}/containers

Hand over containers under a committed partition

Moves sole ownership of each named container the caller owns to the other party to the split and revokes the caller's container-level access. Bounded by the sealed manifest's per-party allocation counts.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`splitId`	path	`string`	yes	—

Request body

Not marked as required in the document.

RebindSplitContainersRequestDto as application/*+json, application/json, text/json

Responses

200Batch processed. — RebindSplitContainersResultDto

400Invalid request. — ProblemDetails

401Caller is not authenticated. — ProblemDetails

404No such split, or the caller is not a party to it. — ProblemDetails

VaultMerge

POST/api/v1/vaults/merge/preview

Preview an account merge

Classifies the source vault's holdings against the target vault (metadata only) and returns the side-by-side breakdown. Commits nothing.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

PreviewVaultMergeRequestDto as application/*+json, application/json, text/json

Responses

200The merge preview. — VaultMergePreviewDto

400Invalid request (same vault, missing ids). — ProblemDetails

403The caller does not own both vaults. — ProblemDetails

404One of the vaults does not exist. — ProblemDetails

POST/api/v1/vaults/merge/{mergeId}/apply

Apply an account merge

Commits the merge, recording an outcome for every item — including unreadable documents (never dropped) — and returns the receipt.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`mergeId`	path	`string (uuid)`	yes	—

Request body

No request body.

Responses

200The reconciliation receipt (per-item outcomes). — VaultMergeReceiptDto

403The caller does not own the merge. — ProblemDetails

404The merge does not exist. — ProblemDetails

GET/api/v1/vaults/merge/{mergeId}/conflicts

List merge conflicts

Returns the critical (needs-human) and auto-resolvable conflicts for the given holding domain.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`mergeId`	path	`string (uuid)`	yes	—
`domain`	query	`string`	no	—

Request body

No request body.

Responses

200The conflict split (critical vs auto-resolved). — MergeConflictsDto

403The caller does not own the merge. — ProblemDetails

404The merge does not exist. — ProblemDetails

POST/api/v1/vaults/merge/{mergeId}/conflicts/stage

Stage merge conflict resolutions

Records the caller's resolution choice for each named conflict. Commits nothing to the vaults.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`mergeId`	path	`string (uuid)`	yes	—

Request body

Not marked as required in the document.

StageMergeConflictsRequestDto as application/*+json, application/json, text/json

Responses

200The refreshed conflict list. — MergeConflictsDto

400Invalid resolution payload. — ProblemDetails

403The caller does not own the merge. — ProblemDetails

404The merge does not exist. — ProblemDetails

409A resolution targets a non-conflict item or an already-applied merge. — ProblemDetails

Vaults

GET/api/v1/Vaults

List user's vaults

Retrieves a paginated list of all vaults owned by the authenticated user.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`pageNumber`	query	`integer (int32)`	no	The page number (default: 1).
`pageSize`	query	`integer (int32)`	no	The page size (default: 10, max: 100).
`includeInactive`	query	`boolean`	no	Include inactive (soft-deleted) vaults (default: false).

Request body

No request body.

Responses

200Vault list retrieved successfully. — VaultDtoPagedResultDto

400Invalid pagination parameters. — ProblemDetails

401User is not authenticated. — ProblemDetails

POST/api/v1/Vaults

Create a new vault

Creates a new zero-knowledge encrypted vault. All encryption metadata must be provided by the client.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

CreateVaultCommand as application/*+json, application/json, text/json

Responses

201Vault created successfully. — VaultDto

400Invalid request data or duplicate vault name. — ProblemDetails

401User is not authenticated. — ProblemDetails

GET/api/v1/Vaults/provisioning-status

Default-vault provisioning status

Reports whether the authenticated user's default vault exists yet, is still being provisioned, or is delayed.

Authentication:Bearer (the document-wide requirement)

Parameters

Takes no parameters.

Request body

No request body.

Responses

200Provisioning status retrieved successfully. — DefaultVaultProvisioningStatusDto

401User is not authenticated. — ProblemDetails

GET/api/v1/Vaults/{id}

Get vault by ID

Retrieves detailed information about a specific vault by ID. User must be the vault owner.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The vault ID.

Request body

No request body.

Responses

200Vault retrieved successfully. — VaultDto

401User is not authenticated. — ProblemDetails

403User does not own this vault. — ProblemDetails

404Vault not found. — ProblemDetails

PUT/api/v1/Vaults/{id}

Update vault

Updates a vault's name and settings. User must be the vault owner.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The vault ID.

Request body

Not marked as required in the document.

UpdateVaultCommand as application/*+json, application/json, text/json

Responses

200Vault updated successfully. — VaultDto

400Invalid request data. — ProblemDetails

401User is not authenticated. — ProblemDetails

403User does not own this vault. — ProblemDetails

404Vault not found. — ProblemDetails

DELETE/api/v1/Vaults/{id}

Delete vault

Soft deletes a vault by marking it as inactive. Documents are not automatically deleted. User must be the vault owner.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The vault ID.

Request body

No request body.

Responses

204Vault deleted successfully.

401User is not authenticated. — ProblemDetails

403User does not own this vault. — ProblemDetails

404Vault not found. — ProblemDetails

GET/api/v1/Vaults/{id}/attention

Cross-instance sovereign vault provisioning (FR-03). Called service-to-service by the Global instance's vault router to create a user's default vault IN THIS Sovereign instance. Authenticated with the scoped platform service token (`ServiceProvisioning` scheme, and `scope=vault:provision` — the scheme also guards shared-blob destruction, so the scope is what keeps a blob-purge credential from reaching this route, debt-2026-08-27-213), NOT a user token: the caller supplies the target `OwnerId` in the body (there is no user principal). Never exposed to end users and never routed to on the Global instance (the never-Global guard in the create handler rejects it there).

Board 21c makes the attention queue the one deliberate exception to vault scoping: a naturalisation running since October cannot vanish because somebody switched vaults to check a tenancy. One vault per call; the client fans out. A Global endpoint aggregating every vault would concentrate, in one place, a map of what needs doing across all of a person's jurisdictions — the concentration regional sovereignty exists to prevent. Metadata only. Expiring DOCUMENTS are deliberately absent: an expiry date is a SecureField value, derived on the client after decryption, so it cannot cross a vault boundary without the server holding plaintext.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The vault to ask about — usually one the caller is NOT currently in.

Request body

No request body.

Responses

200The vault's attention rows. — VaultAttentionDto

201Vault created in this Sovereign instance.

401Unauthorized — ProblemDetails

404The caller does not own that vault. — ProblemDetails

409A default vault already exists for the owner (idempotent no-op).

POST/api/v1/Vaults/{id}/storage/reconcile

Reconcile vault storage usage

Recomputes the vault's storage counter from the total size of its active documents and corrects any drift. Idempotent. User must be the vault owner.

Authentication:Bearer (the document-wide requirement)

Parameters

Name	In	Type	Required	Description
`id`	path	`string (uuid)`	yes	The vault ID.

Request body

No request body.

Responses

200Reconciliation completed. — VaultStorageReconciliationDto

401User is not authenticated. — ProblemDetails

403User does not own this vault. — ProblemDetails

404Vault not found. — ProblemDetails

Schemas

AcceptMergeResolutionsRequestDto

Property	Type	Required	Description
`resolutions`	`MergeResolutionChoiceDto[] \| null`	no	—

AcceptWardOwnershipRequestDto

Property	Type	Required	Description
`keyCustodyReference`	`string \| null`	no	—

AccessReconstructionDto

Property	Type	Required	Description
`actorUserId`	`string (uuid)`	no	—
`endedAt`	`string (date-time)`	no	—
`eventCount`	`integer (int32)`	no	—
`events`	`AccessReconstructionEventDto[] \| null`	no	—
`startedAt`	`string (date-time)`	no	—

AccessReconstructionEventDto

Property	Type	Required	Description
`accessType`	`string \| null`	no	—
`fieldId`	`string \| null`	no	—
`occurredAt`	`string (date-time)`	no	—
`resourceId`	`string (uuid)`	no	—
`resourceType`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

ActivateTemplateCommandResult

Property	Type	Required	Description
`isActive`	`boolean`	no	—
`name`	`string \| null`	no	—
`templateId`	`string (uuid)`	no	—

AddDocumentCommand

Property	Type	Required	Description
`algorithmVersion`	`integer (int32)`	no	—
`authenticationTag`	`string \| null`	no	—
`categoryId`	`string (uuid) \| null`	no	—
`contentFormat`	`string \| null`	no	—
`contentHash`	`string \| null`	no	—
`description`	`string \| null`	no	—
`encryptedContent`	`string (byte) \| null`	no	—
`fhir`	`FhirMetadataDto`	no	—
`fields`	`FieldEnvelopeInput[] \| null`	no	—
`fileName`	`string \| null`	no	—
`initializationVector`	`string \| null`	no	—
`issuanceEvidence`	`DocumentIssuanceEvidenceDto`	no	—
`keyDerivationFunction`	`string \| null`	no	—
`keyGeneration`	`integer (int32)`	no	—
`keyId`	`string \| null`	no	—
`mimeType`	`string \| null`	no	—
`ownerId`	`string (uuid)`	no	—
`salt`	`string \| null`	no	—
`schemaRef`	`string \| null`	no	—
`schemaVersion`	`string \| null`	no	—
`sensitivityLabel`	`string \| null`	no	—
`sizeBytes`	`integer (int64)`	no	—
`tags`	`string[] \| null`	no	—
`vaultId`	`string (uuid)`	no	—

AddDocumentTagsRequestDto

Property	Type	Required	Description
`tags`	`string[] \| null`	no	—

AddOrganizationKeyHolderRequest

Property	Type	Required	Description
`newHolderUserId`	`string (uuid)`	no	—
`wrappedMasterKey`	`string \| null`	no	—
`wrappedPrivateKey`	`string \| null`	no	—

AdministrativeVaultAccessEffectDto

Property	Type	Required	Description
`effectiveAt`	`string (date-time) \| null`	no	—
`operationClass`	`string \| null`	no	—
`outcome`	`string \| null`	no	—
`stateChanged`	`boolean`	no	—
`subjectUserId`	`string (uuid)`	no	—

AdministrativeVaultAccessEffectRequestDto

Property	Type	Required	Description
`operationClass`	`string \| null`	no	—
`operationReference`	`string \| null`	no	—

AnonymousDataRequestDto

Property	Type	Required	Description
`createdAt`	`string (date-time)`	no	—
`expiresAt`	`string (date-time)`	no	—
`privacyTermsJson`	`string \| null`	no	—
`requestId`	`string (uuid)`	no	—
`requestedFieldsJson`	`string \| null`	no	—
`requesterLegalName`	`string \| null`	no	—
`requesterRegistryScheme`	`string \| null`	no	—
`requesterRegistryValue`	`string \| null`	no	—
`requesterType`	`string \| null`	no	—
`requesterUnverifiedReason`	`string \| null`	no	—
`requesterVerified`	`boolean`	no	—
`status`	`string \| null`	no	—

ApproveDataRequestCommand

Property	Type	Required	Description
`approvedFieldsJson`	`string \| null`	no	—
`dataRequestId`	`string (uuid)`	no	—
`keepCurrent`	`boolean`	no	—
`keepCurrentUntil`	`string (date-time) \| null`	no	—
`targetUserId`	`string (uuid)`	no	—

AttachNewbornSeedRecordRequestDto

Property	Type	Required	Description
`documentId`	`string (uuid)`	no	—

AttorneyFirstAccessLandingDto

Property	Type	Required	Description
`auditNotice`	`string \| null`	no	—
`authorityRecordId`	`string (uuid)`	no	—
`donorUserId`	`string (uuid)`	no	—
`expiresAt`	`string (date-time)`	no	—
`permittedActions`	`string[] \| null`	no	—
`scopeGrantId`	`string (uuid)`	no	—
`scopedCategories`	`string[] \| null`	no	—
`scopedDocumentIds`	`(string (uuid))[] \| null`	no	—
`scopedFieldIds`	`string[] \| null`	no	—
`vaultId`	`string (uuid)`	no	—

AttorneyReadAuditEntryDto

Property	Type	Required	Description
`attorneyUserId`	`string (uuid)`	no	—
`decision`	`string \| null`	no	—
`donorUserId`	`string (uuid)`	no	—
`fieldId`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`occurredAt`	`string (date-time)`	no	—
`reason`	`string \| null`	no	—
`resourceId`	`string (uuid)`	no	—
`resourceType`	`string \| null`	no	—
`scopeGrantId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

AttorneyScopedDocumentDto

Property	Type	Required	Description
`authorityRecordId`	`string (uuid)`	no	—
`documentId`	`string (uuid)`	no	—
`inScopeFieldIds`	`string[] \| null`	no	—
`permittedActions`	`string[] \| null`	no	—
`scopeGrantId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

AttorneyScopeGrantSummaryDto

Property	Type	Required	Description
`authorityRecordId`	`string (uuid)`	no	—
`donorUserId`	`string (uuid)`	no	—
`expiresAt`	`string (date-time)`	no	—
`scopeGrantId`	`string (uuid)`	no	—
`status`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

AttorneyVaultScopeGrantDto

Property	Type	Required	Description
`attorneyUserId`	`string (uuid)`	no	—
`authorityRecordId`	`string (uuid)`	no	—
`donorUserId`	`string (uuid)`	no	—
`expiresAt`	`string (date-time)`	no	—
`grantedAt`	`string (date-time)`	no	—
`id`	`string (uuid)`	no	—
`isActive`	`boolean`	no	—
`revokedAt`	`string (date-time) \| null`	no	—
`scopedCategories`	`string[] \| null`	no	—
`scopedDocumentIds`	`(string (uuid))[] \| null`	no	—
`scopedFieldIds`	`string[] \| null`	no	—
`status`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

AuthorizeEstateReleaseRequestDto

Property	Type	Required	Description
`probateGranted`	`boolean`	no	—

BatchFieldShareResultDto

Property	Type	Required	Description
`failedCount`	`integer (int32)`	no	—
`requestedCount`	`integer (int32)`	no	—
`results`	`FieldShareResultItemDto[] \| null`	no	—
`succeededCount`	`integer (int32)`	no	—

BequeathedDocumentDto

Property	Type	Required	Description
`available`	`boolean`	no	—
`documentId`	`string \| null`	no	—
`expiresAt`	`string (date-time) \| null`	no	—
`lockedReason`	`string \| null`	no	—
`tier`	`string \| null`	no	—
`title`	`string \| null`	no	—

BequestDeclaredResponseDto

Property	Type	Required	Description
`estateId`	`string (uuid)`	no	—
`itemId`	`string (uuid)`	no	—

CancelUploadCommand

Property	Type	Required	Description
`reason`	`string \| null`	no	—
`requestingUserId`	`string (uuid)`	no	—
`uploadSessionId`	`string (uuid)`	no	—

CandidateDocumentDto

Property	Type	Required	Description
`createdAt`	`string (date-time)`	no	—
`dataClassificationLevel`	`string \| null`	no	—
`documentId`	`string (uuid)`	no	—
`fields`	`CandidateFieldDto[] \| null`	no	—
`schemaName`	`string \| null`	no	—
`schemaRef`	`string \| null`	no	—
`title`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

CandidateDocumentsDto

Property	Type	Required	Description
`candidates`	`CandidateDocumentDto[] \| null`	no	—
`checkId`	`string \| null`	no	—
`requestId`	`string (uuid)`	no	—
`requestedSchemas`	`CandidateSchemaDto[] \| null`	no	—

CandidateFieldDto

Property	Type	Required	Description
`dataClassificationLevel`	`string \| null`	no	—
`fieldId`	`string \| null`	no	—
`mandatory`	`boolean`	no	—
`purpose`	`string \| null`	no	—
`requiredForCheck`	`boolean`	no	—

CandidateSchemaDto

Property	Type	Required	Description
`candidateCount`	`integer (int32)`	no	—
`requestedSchemaRef`	`string \| null`	no	—
`schemaName`	`string \| null`	no	—
`schemaRef`	`string \| null`	no	—
`unresolved`	`boolean`	no	—

CascadeStatusDto

Property	Type	Required	Description
`changeId`	`string (uuid)`	no	—
`coverage`	`RelyingPartyCoverageDto`	no	—
`credentials`	`CredentialReissueDto[] \| null`	no	—
`names`	`NamePairDto`	no	—
`reattestation`	`string \| null`	no	—

CategoryDto

Property	Type	Required	Description
`childCategories`	`CategoryDto[] \| null`	no	—
`colorCode`	`string \| null`	no	—
`createdAt`	`string (date-time)`	no	—
`deletedAt`	`string (date-time) \| null`	no	—
`description`	`string \| null`	no	—
`displayOrder`	`integer (int32)`	no	—
`documentCount`	`integer (int32)`	no	—
`icon`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`isDeleted`	`boolean`	no	—
`modifiedAt`	`string (date-time) \| null`	no	—
`name`	`string \| null`	no	—
`parentCategoryId`	`string (uuid) \| null`	no	—
`vaultId`	`string (uuid)`	no	—

CategoryDtoPagedResultDto

Property	Type	Required	Description
`hasNextPage`	`boolean`	no	—
`hasPreviousPage`	`boolean`	no	—
`items`	`CategoryDto[] \| null`	no	—
`pageNumber`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`totalCount`	`integer (int32)`	no	—
`totalPages`	`integer (int32)`	no	—

CategoryStatisticsDto

Property	Type	Required	Description
`averageDocumentsPerCategory`	`number (double)`	no	—
`maximumDepth`	`integer (int32)`	no	—
`rootCategories`	`integer (int32)`	no	—
`totalCategories`	`integer (int32)`	no	—
`totalDocuments`	`integer (int32)`	no	—

CategorySuggestion

Property	Type	Required	Description
`categoryId`	`string (uuid)`	no	—
`categoryName`	`string \| null`	no	—
`confidence`	`number (double)`	no	—

ChildCustodianMembershipDto

Property	Type	Required	Description
`capabilities`	`string \| null`	no	—
`custodianUserId`	`string (uuid)`	no	—
`linkedAt`	`string (date-time)`	no	—
`role`	`string \| null`	no	—
`sourceLinkRef`	`string (uuid)`	no	—

ChildSharedRecordsSpaceDto

Property	Type	Required	Description
`childId`	`string (uuid)`	no	—
`custodians`	`ChildCustodianMembershipDto[] \| null`	no	—
`provisionedAt`	`string (date-time)`	no	—
`spaceId`	`string (uuid)`	no	—
`status`	`string \| null`	no	—

ClaimOrganizationKeyHolderByRecoveryKitRequest

Property	Type	Required	Description
`verifier`	`string \| null`	no	—
`wrappedMasterKey`	`string \| null`	no	—
`wrappedPrivateKey`	`string \| null`	no	—

CompareDocumentVersionsQueryResult

Property	Type	Required	Description
`areIdentical`	`boolean`	no	—
`differences`	`VersionDifference[] \| null`	no	—
`documentId`	`string (uuid)`	no	—
`versionNumber1`	`integer (int32)`	no	—
`versionNumber2`	`integer (int32)`	no	—

CompletenessAttestationDto

Property	Type	Required	Description
`anchorReference`	`string \| null`	no	—
`attestedAt`	`string (date-time)`	no	—
`blockHeight`	`integer (int64) \| null`	no	—
`completenessHash`	`string \| null`	no	—
`verdictLevel`	`string \| null`	no	—

CompleteUploadCommand

Property	Type	Required	Description
`algorithmVersion`	`integer (int32)`	no	—
`authenticationTag`	`string \| null`	no	—
`categoryId`	`string (uuid) \| null`	no	—
`description`	`string \| null`	no	—
`fields`	`FieldEnvelopeInput[] \| null`	no	—
`initializationVector`	`string \| null`	no	—
`keyDerivationFunction`	`string \| null`	no	—
`keyGeneration`	`integer (int32)`	no	—
`keyId`	`string \| null`	no	—
`requestingUserId`	`string (uuid)`	no	—
`salt`	`string \| null`	no	—
`schemaRef`	`string \| null`	no	—
`schemaVersion`	`string \| null`	no	—
`tags`	`string[] \| null`	no	—
`uploadSessionId`	`string (uuid)`	no	—

CompleteUploadCommandResult

Property	Type	Required	Description
`blobStoragePath`	`string \| null`	no	—
`documentId`	`string (uuid) \| null`	no	—
`message`	`string \| null`	no	—
`quarantined`	`boolean`	no	—
`status`	`string \| null`	no	—
`success`	`boolean`	no	—
`threatName`	`string \| null`	no	—

ConfirmCustodyDestructionRequestDto

Property	Type	Required	Description
`evidenceDigest`	`string \| null`	no	—

ConfirmReconciliationRequestDto

Property	Type	Required	Description
`bootstrapDecisionId`	`string (uuid)`	no	—
`homeVaultId`	`string (uuid)`	no	—
`sameMeConsent`	`boolean`	no	—

ConsentTeardownPreviewDto

Property	Type	Required	Description
`cachedCopyCount`	`integer (int32)`	no	—
`consentId`	`string (uuid)`	no	—
`derivedShareCount`	`integer (int32)`	no	—

ContactErasureAttestationDto

Property	Type	Required	Description
`auditAnchorRef`	`string \| null`	no	—
`contactLinkId`	`string (uuid)`	no	—
`contentDigest`	`string \| null`	no	—
`erasedAt`	`string (date-time)`	no	—
`handoverRecordId`	`string (uuid)`	no	—
`ownerUserId`	`string (uuid)`	no	—

ContactHandoverRecordDto

Property	Type	Required	Description
`closureContext`	`string (uuid) \| null`	no	—
`contactLinkId`	`string (uuid)`	no	—
`disposition`	`string \| null`	no	—
`handedOverAt`	`string (date-time)`	no	—
`handoverRecordId`	`string (uuid)`	no	—
`ownerUserId`	`string (uuid)`	no	—
`recoveryWindowExpiresAt`	`string (date-time) \| null`	no	—
`status`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

CounterpartyConsentLedgerRow

Property	Type	Required	Description
`counterpartyId`	`string (uuid)`	no	—
`fieldsHeld`	`integer (int32)`	no	—
`liveConsents`	`integer (int32)`	no	—
`nextFieldExpiry`	`string (date-time) \| null`	no	—

CounterpartyOrganizationConsentLedgerRow

Property	Type	Required	Description
`counterpartyOrganizationId`	`string (uuid)`	no	—
`fieldsHeld`	`integer (int32)`	no	—
`liveConsents`	`integer (int32)`	no	—
`nextFieldExpiry`	`string (date-time) \| null`	no	—

CourtAuthorityScopedDocumentDto

Property	Type	Required	Description
`authorityId`	`string (uuid) \| null`	no	—
`documentId`	`string (uuid)`	no	—
`orderReference`	`string \| null`	no	—
`permittedActions`	`string[] \| null`	no	—
`scopeCategory`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—
`wardId`	`string (uuid)`	no	—

CreateCategoryCommand

Property	Type	Required	Description
`colorCode`	`string \| null`	no	—
`description`	`string \| null`	no	—
`displayOrder`	`integer (int32)`	no	—
`icon`	`string \| null`	no	—
`name`	`string \| null`	no	—
`parentCategoryId`	`string (uuid) \| null`	no	—
`vaultId`	`string (uuid)`	no	—

CreateDataRequestCommand

Property	Type	Required	Description
`expiresAt`	`string (date-time) \| null`	no	—
`privacyTermsJson`	`string \| null`	no	—
`requestedFieldsJson`	`string \| null`	no	—
`requesterId`	`string (uuid)`	no	—
`requesterType`	`string \| null`	no	—
`targetUserId`	`string (uuid) \| null`	no	—

CreateDocumentShareCommand

Property	Type	Required	Description
`accessLevel`	`string \| null`	no	—
`createdByUserId`	`string (uuid)`	no	—
`documentId`	`string (uuid)`	no	—
`expiresAt`	`string (date-time) \| null`	no	—
`sharedWithUserId`	`string (uuid) \| null`	no	—
`versionNumber`	`integer (int32) \| null`	no	—

CreateDocumentVersionCommand

Property	Type	Required	Description
`changeDescription`	`string \| null`	no	—
`documentId`	`string (uuid)`	no	—
`userId`	`string (uuid)`	no	—

CreateFieldShareCommand

Property	Type	Required	Description
`createdByUserId`	`string (uuid)`	no	—
`documentId`	`string (uuid)`	no	—
`fields`	`CreateFieldShareItem[] \| null`	no	—

CreateFieldShareItem

Property	Type	Required	Description
`accessLevel`	`string \| null`	no	—
`consentId`	`string (uuid) \| null`	no	—
`expiresAt`	`string (date-time) \| null`	no	—
`fieldId`	`string \| null`	no	—
`fieldLabel`	`string \| null`	no	—
`recipientDisplayName`	`string \| null`	no	—
`recipientKeyUnavailable`	`boolean`	no	—
`recipientOrgId`	`string (uuid) \| null`	no	—
`recipientType`	`string \| null`	no	—
`recipientUserId`	`string (uuid) \| null`	no	—
`sharerDisplayName`	`string \| null`	no	—
`sharerNote`	`string \| null`	no	—
`sharerType`	`string \| null`	no	—
`wrappedFieldKeyBase64`	`string \| null`	no	—

CreateFieldSubscriptionCommand

Property	Type	Required	Description
`consentId`	`string (uuid)`	no	—
`documentId`	`string (uuid)`	no	—
`fieldId`	`string \| null`	no	—
`maxSyncs`	`integer (int32) \| null`	no	—
`subscriberId`	`string (uuid)`	no	—
`subscriberType`	`string \| null`	no	—
`syncType`	`string \| null`	no	—
`validFrom`	`string (date-time) \| null`	no	—
`validTo`	`string (date-time) \| null`	no	—

CreateSelfExclusionRequest

Request body for `POST /api/v1/self-exclusion`. Matches the essence-web `CreateExclusionRequest` client contract.

Property	Type	Required	Description
`confirmedSelfExclude`	`boolean`	no	The explicit hard-commitment confirmation — the server rejects a false.
`durationDays`	`integer (int32)`	no	Committed term in days. Ignored by the server when Essence.Core.Vault.Api.Controllers.CreateSelfExclusionRequest.Permanent is true.
`jurisdiction`	`string \| null`	no	Regulator jurisdiction code (e.g. "GB").
`permanent`	`boolean`	no	When true, requests a permanent (no-reinstatement) exclusion the server treats as never-liftable. Matches the essence-web `CreateExclusionRequest.permanent` flag.

CreateTemplateCommand

Property	Type	Required	Description
`category`	`string \| null`	no	—
`description`	`string \| null`	no	—
`fieldMappings`	`TemplateFieldMappingDto[] \| null`	no	—
`icon`	`string \| null`	no	—
`localizedDescriptions`	`map<string, string> \| null`	no	—
`localizedNames`	`map<string, string> \| null`	no	—
`name`	`string \| null`	no	—
`previewImage`	`string \| null`	no	—
`schemaRef`	`string \| null`	no	—

CreateTemplateCommandResult

Property	Type	Required	Description
`category`	`string \| null`	no	—
`createdAt`	`string (date-time)`	no	—
`isActive`	`boolean`	no	—
`name`	`string \| null`	no	—
`schemaRef`	`string \| null`	no	—
`templateId`	`string (uuid)`	no	—

CreateVaultCommand

Property	Type	Required	Description
`authenticationTag`	`string \| null`	no	—
`autoDeleteDays`	`integer (int32) \| null`	no	—
`autoDeleteEnabled`	`boolean`	no	—
`description`	`string \| null`	no	—
`homeRegion`	`string \| null`	no	—
`initializationVector`	`string \| null`	no	—
`isDefault`	`boolean`	no	—
`keyId`	`string \| null`	no	—
`maxDocuments`	`integer (int32) \| null`	no	—
`maxStorageSizeBytes`	`integer (int64) \| null`	no	—
`name`	`string \| null`	no	—
`organizationId`	`string (uuid) \| null`	no	—
`ownerId`	`string (uuid)`	no	—
`salt`	`string \| null`	no	—
`vaultType`	`string \| null`	no	—

CredentialFanoutOutcome

Property	Type	Required	Description
`credentialId`	`string (uuid)`	no	—
`held`	`boolean`	no	—
`kind`	`string \| null`	no	—
`markedCompromised`	`boolean`	no	—
`name`	`string \| null`	no	—
`reason`	`string \| null`	no	—
`reissueRequested`	`boolean`	no	—

CredentialReissueDto

Property	Type	Required	Description
`auditAnchor`	`string \| null`	no	—
`credentialClass`	`string \| null`	no	—
`credentialId`	`string (uuid)`	no	—
`detail`	`string \| null`	no	—
`evidenceDeedPollDocumentId`	`string (uuid) \| null`	no	—
`kycResult`	`string \| null`	no	—
`label`	`string \| null`	no	—
`oldStillValid`	`boolean`	no	—
`reissuedAtIso`	`string \| null`	no	—
`state`	`string \| null`	no	—

CrossVaultSearchFacetBucketDto

Property	Type	Required	Description
`count`	`integer (int32)`	no	—
`value`	`string \| null`	no	—

CrossVaultSearchFacets

Property	Type	Required	Description
`access`	`CrossVaultSearchFacetBucketDto[] \| null`	no	—
`category`	`CrossVaultSearchFacetBucketDto[] \| null`	no	—
`dateRange`	`CrossVaultSearchFacetBucketDto[] \| null`	no	—
`schema`	`CrossVaultSearchFacetBucketDto[] \| null`	no	—
`tags`	`CrossVaultSearchFacetBucketDto[] \| null`	no	—
`vault`	`CrossVaultSearchFacetBucketDto[] \| null`	no	—

CrossVaultSearchHitDto

Property	Type	Required	Description
`access`	`string \| null`	no	—
`category`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`mimeType`	`string \| null`	no	—
`name`	`string \| null`	no	—
`schemaRef`	`string \| null`	no	—
`score`	`number (double)`	no	—
`statusOnly`	`boolean`	no	—
`tags`	`string[] \| null`	no	—
`updatedAt`	`string (date-time)`	no	—
`vaultId`	`string (uuid)`	no	—

CrossVaultSearchRequest

Property	Type	Required	Description
`access`	`string[] \| null`	no	—
`categories`	`string[] \| null`	no	—
`dateRange`	`string \| null`	no	—
`page`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`query`	`string \| null`	no	—
`schemas`	`string[] \| null`	no	—
`tags`	`string[] \| null`	no	—
`vaultIds`	`(string (uuid))[] \| null`	no	—

CrossVaultSearchResponse

Property	Type	Required	Description
`engine`	`string \| null`	no	—
`facets`	`CrossVaultSearchFacets`	no	—
`facetsWithheld`	`string \| null`	no	—
`instancesSearched`	`string[] \| null`	no	—
`page`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`query`	`string \| null`	no	—
`results`	`CrossVaultSearchHitDto[] \| null`	no	—
`total`	`integer (int32)`	no	—

CustodialKeyDepositDto

Property	Type	Required	Description
`custodyKeyId`	`string \| null`	no	—
`depositedAt`	`string (date-time)`	no	—
`sealedToKeyId`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

CustodialKeyDto

Property	Type	Required	Description
`custodialKeyId`	`string \| null`	no	—
`programmeMemberId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

CustodialRecordImportResultDto

Property	Type	Required	Description
`created`	`boolean`	no	—
`documentId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

CustodianGrantDto

Property	Type	Required	Description
`accessGrantedAt`	`string (date-time)`	no	—
`guardianUserId`	`string (uuid)`	no	—
`role`	`string \| null`	no	—

CustodyHandedOverDto

Property	Type	Required	Description
`evidenceDigest`	`string \| null`	no	—
`handedOverAt`	`string (date-time)`	no	—
`programmeMemberId`	`string (uuid)`	no	—
`securedDocumentCount`	`integer (int32)`	no	—
`vaultId`	`string (uuid)`	no	—

CustodyHandOverStatusDto

Property	Type	Required	Description
`completedAt`	`string (date-time) \| null`	no	—
`memberOrganizationId`	`string (uuid)`	no	—
`message`	`string \| null`	no	—
`recordsSecured`	`integer (int32)`	no	—
`recordsTotal`	`integer (int32)`	no	—
`stage`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

CustodyTransferCertificateDto

Property	Type	Required	Description
`documentType`	`string \| null`	no	—
`documentVersion`	`string \| null`	no	—
`issuedAt`	`string (date-time)`	no	—
`jurisdiction`	`string \| null`	no	—
`supervisionStatus`	`string \| null`	no	—
`transfer`	`CustodyTransferDto`	no	—

CustodyTransferDto

Property	Type	Required	Description
`authorisedByUserId`	`string (uuid)`	no	—
`custodyTransferId`	`string (uuid)`	no	—
`minorUserId`	`string (uuid)`	no	—
`newCustodians`	`CustodianGrantDto[] \| null`	no	—
`orderReference`	`string \| null`	no	—
`priorGuardians`	`PriorGuardianSeveranceDto[] \| null`	no	—
`provisioningId`	`string (uuid)`	no	—
`revokedGuardianCount`	`integer (int32)`	no	—
`transferredAt`	`string (date-time)`	no	—
`vaultId`	`string (uuid)`	no	—

DataRequestDto

Property	Type	Required	Description
`createdAt`	`string (date-time)`	no	—
`expiresAt`	`string (date-time)`	no	—
`grantKind`	`string \| null`	no	—
`grantValidTo`	`string (date-time) \| null`	no	—
`injectedDocumentAccessStatement`	`string \| null`	no	—
`injectedDocumentId`	`string (uuid) \| null`	no	—
`injectedDocumentReadability`	`string \| null`	no	—
`privacyTermsJson`	`string \| null`	no	—
`requestId`	`string (uuid)`	no	—
`requestedFieldsJson`	`string \| null`	no	—
`requesterId`	`string (uuid)`	no	—
`requesterType`	`string \| null`	no	—
`shareToken`	`string \| null`	no	—
`status`	`string \| null`	no	—
`targetUserId`	`string (uuid) \| null`	no	—

DataRequestSummaryDto

Property	Type	Required	Description
`createdAt`	`string (date-time)`	no	—
`expiresAt`	`string (date-time)`	no	—
`grantKind`	`string \| null`	no	—
`grantValidTo`	`string (date-time) \| null`	no	—
`injectedDocumentId`	`string (uuid) \| null`	no	—
`privacyTermsJson`	`string \| null`	no	—
`requestId`	`string (uuid)`	no	—
`requestedFieldsJson`	`string \| null`	no	—
`requesterDisplayName`	`string \| null`	no	—
`requesterId`	`string (uuid) \| null`	no	—
`requesterRegistryRef`	`string \| null`	no	—
`requesterType`	`string \| null`	no	—
`requesterUnverifiedReason`	`string \| null`	no	—
`requesterVerified`	`boolean`	no	—
`status`	`string \| null`	no	—
`targetUserId`	`string (uuid) \| null`	no	—

DataRequestSummaryDtoPagedResultDto

Property	Type	Required	Description
`hasNextPage`	`boolean`	no	—
`hasPreviousPage`	`boolean`	no	—
`items`	`DataRequestSummaryDto[] \| null`	no	—
`pageNumber`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`totalCount`	`integer (int32)`	no	—
`totalPages`	`integer (int32)`	no	—

DeactivateTemplateCommandResult

Property	Type	Required	Description
`isActive`	`boolean`	no	—
`name`	`string \| null`	no	—
`templateId`	`string (uuid)`	no	—

DeclareBequestRequestDto

Property	Type	Required	Description
`delayHours`	`integer (int32)`	no	—
`documentRef`	`string \| null`	no	—
`executorUserId`	`string (uuid)`	no	—
`expiresAt`	`string (date-time) \| null`	no	—
`tier`	`string \| null`	no	—
`title`	`string \| null`	no	—

DefaultVaultProvisioningStatusDto

Property	Type	Required	Description
`attempts`	`integer (int32)`	no	—
`pendingSince`	`string (date-time) \| null`	no	—
`status`	`string \| null`	no	—

DelegatedWriteAttributionDto

Property	Type	Required	Description
`delegateKind`	`string \| null`	no	—
`delegateSubjectId`	`string (uuid) \| null`	no	—
`delegateUserId`	`string (uuid) \| null`	no	—
`delegationGrantId`	`string (uuid) \| null`	no	—
`id`	`string (uuid)`	no	—
`justification`	`string \| null`	no	—
`occurredAt`	`string (date-time)`	no	—
`operation`	`string \| null`	no	—
`principalUserId`	`string (uuid)`	no	—
`resourceId`	`string (uuid)`	no	—
`resourceType`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

DepositCustodialKeyRequestDto

Property	Type	Required	Description
`custodyKeyId`	`string \| null`	no	—
`sealedKey`	`string (byte) \| null`	no	—
`sealedToKeyId`	`string \| null`	no	—

DerivedShareReconciliationDto

Property	Type	Required	Description
`batchId`	`string (uuid)`	no	—
`cachedCopies`	`TeardownCohortDto`	no	—
`complete`	`boolean`	no	—
`consentCount`	`integer (int32)`	no	—
`derivedShares`	`TeardownCohortDto`	no	—

DerivedShareRevocationBatchDto

Property	Type	Required	Description
`batchId`	`string (uuid)`	no	—
`consentCount`	`integer (int32)`	no	—
`createdAt`	`string (date-time)`	no	—
`expectedShareCount`	`integer (int32)`	no	—
`expectedSubscriptionCount`	`integer (int32)`	no	—

DerivedSharesPreviewDto

Property	Type	Required	Description
`cachedCopyCount`	`integer (int32)`	no	—
`derivedShareCount`	`integer (int32)`	no	—
`perConsent`	`ConsentTeardownPreviewDto[] \| null`	no	—
`totalTeardownCount`	`integer (int32)`	no	—

DisposeReconciliationDisputeRequestDto

Property	Type	Required	Description
`disposition`	`string \| null`	no	—
`disputeId`	`string (uuid)`	no	—
`note`	`string \| null`	no	—

DocumentActivityDto

Property	Type	Required	Description
`activityType`	`string \| null`	no	—
`actorUserId`	`string (uuid)`	no	—
`documentId`	`string (uuid)`	no	—
`fieldId`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`occurredAt`	`string (date-time)`	no	—
`vaultId`	`string (uuid)`	no	—

DocumentActivityPageDto

Property	Type	Required	Description
`activities`	`DocumentActivityDto[] \| null`	no	—
`page`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`total`	`integer (int32)`	no	—

DocumentArchiveScope

0 | 1 | 2 with no declared properties.

DocumentContentDto

Property	Type	Required	Description
`ciphertext`	`string \| null`	no	—
`envelope`	`DocumentEnvelopeDto`	no	—
`fileName`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`mimeType`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

DocumentDeletionResultDto

Property	Type	Required	Description
`cancelledFieldSubscriptions`	`integer (int32)`	no	—
`notifiedRecipients`	`integer (int32)`	no	—
`revokedAnything`	`boolean`	no	—
`revokedDocumentShares`	`integer (int32)`	no	—
`revokedFieldShares`	`integer (int32)`	no	—

DocumentDto

Property	Type	Required	Description
`archivedAt`	`string (date-time) \| null`	no	—
`categoryId`	`string (uuid) \| null`	no	—
`contentFormat`	`string \| null`	no	—
`contentHash`	`string \| null`	no	—
`createdAt`	`string (date-time)`	no	—
`deletedAt`	`string (date-time) \| null`	no	—
`description`	`string \| null`	no	—
`encryptionAlgorithm`	`string \| null`	no	—
`fhir`	`FhirMetadataDto`	no	—
`fields`	`DocumentFieldSummaryDto[] \| null`	no	—
`fileName`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`isArchived`	`boolean`	no	—
`isDeleted`	`boolean`	no	—
`isSuperseded`	`boolean`	no	—
`issuanceEvidence`	`DocumentIssuanceEvidenceDto`	no	—
`keyId`	`string \| null`	no	—
`mimeType`	`string \| null`	no	—
`modifiedAt`	`string (date-time) \| null`	no	—
`rowVersion`	`string \| null`	no	—
`schemaRef`	`string \| null`	no	—
`schemaVersion`	`string \| null`	no	—
`sensitivityLabel`	`string \| null`	no	—
`sensitivityLabelConfirmed`	`boolean`	no	—
`sensitivityLabelDowngradeRequested`	`string \| null`	no	—
`sizeBytes`	`integer (int64)`	no	—
`statusOnly`	`boolean`	no	—
`supersededAt`	`string (date-time) \| null`	no	—
`supersededByDocumentId`	`string (uuid) \| null`	no	—
`tags`	`string[] \| null`	no	—
`vaultId`	`string (uuid)`	no	—
`version`	`integer (int32)`	no	—
`withdrawalReasonCode`	`string \| null`	no	—
`withdrawnAt`	`string (date-time) \| null`	no	—

DocumentDtoPagedResultDto

Property	Type	Required	Description
`hasNextPage`	`boolean`	no	—
`hasPreviousPage`	`boolean`	no	—
`items`	`DocumentDto[] \| null`	no	—
`pageNumber`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`totalCount`	`integer (int32)`	no	—
`totalPages`	`integer (int32)`	no	—

DocumentEnvelopeDto

Property	Type	Required	Description
`algorithm`	`string \| null`	no	—
`algorithmVersion`	`integer (int32)`	no	—
`authTag`	`string \| null`	no	—
`keyDerivation`	`DocumentKeyDerivationDto`	no	—
`keyGeneration`	`integer (int32)`	no	—
`metadata`	`string \| null`	no	—
`nonce`	`string \| null`	no	—

DocumentFieldSummaryDto

Property	Type	Required	Description
`fieldId`	`string \| null`	no	—
`keyGeneration`	`integer (int32)`	no	—
`ordinal`	`integer (int32)`	no	—

DocumentIssuanceEvidenceDto

Property	Type	Required	Description
`hasSourceImage`	`boolean`	no	—
`isUserAttested`	`boolean`	no	—
`issuedAt`	`string (date-time)`	no	—
`issuerKeyFingerprint`	`string \| null`	no	—
`issuerOrganizationId`	`string (uuid) \| null`	no	—
`signature`	`string \| null`	no	—
`signatureAlgorithm`	`string \| null`	no	—

DocumentKeyDerivationDto

Property	Type	Required	Description
`algorithm`	`string \| null`	no	—
`hash`	`string \| null`	no	—
`info`	`string \| null`	no	—

DocumentLocationDto

Property	Type	Required	Description
`jurisdiction`	`string \| null`	no	—
`schemaRef`	`string \| null`	no	—
`sealedFieldCount`	`integer (int32)`	no	—
`vaultId`	`string (uuid)`	no	—
`vaultName`	`string \| null`	no	—

DocumentOwnershipDto

Response body for `GET /api/v{version}/documents/{id}/ownership` (debt-2026-08-02, EPIC 30 Golden-Rule fix).

Property	Type	Required	Description
`owned`	`boolean`	no	Whether the queried userId owns the document.

DocumentPresenceDto

Property	Type	Required	Description
`counts`	`map<string, integer (int32)> \| null`	no	—

DocumentSearchDto

Property	Type	Required	Description
`categoryId`	`string (uuid) \| null`	no	—
`categoryName`	`string \| null`	no	—
`createdAt`	`string (date-time)`	no	—
`description`	`string \| null`	no	—
`fileExtension`	`string \| null`	no	—
`fileName`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`mimeType`	`string \| null`	no	—
`relevanceScore`	`number (double) \| null`	no	—
`schemaRef`	`string \| null`	no	—
`sensitivityLabel`	`string \| null`	no	—
`sizeBytes`	`integer (int64)`	no	—
`statusOnly`	`boolean`	no	—
`tags`	`string[] \| null`	no	—
`updatedAt`	`string (date-time)`	no	—
`vaultId`	`string (uuid)`	no	—
`version`	`integer (int32)`	no	—
`versionCount`	`integer (int32)`	no	—

DocumentSearchDtoSearchResult

Property	Type	Required	Description
`facets`	`SearchFacet[] \| null`	no	—
`hasNextPage`	`boolean`	no	—
`hasPreviousPage`	`boolean`	no	—
`items`	`DocumentSearchDto[] \| null`	no	—
`pageNumber`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`totalCount`	`integer (int32)`	no	—
`totalPages`	`integer (int32)`	no	—

DocumentSearchRequest

Request model for advanced document search.

Property	Type	Required	Description
`filters`	`SearchFilters`	no	—
`options`	`SearchOptions`	no	—
`query`	`string \| null`	no	Optional search query for full-text search across filenames, descriptions, and tags.
`vaultId`	`string (uuid)`	no	The vault ID to search within.

DocumentShareDto

Property	Type	Required	Description
`accessCount`	`integer (int32)`	no	—
`accessLevel`	`string \| null`	no	—
`ageInDays`	`integer (int32)`	no	—
`canEdit`	`boolean`	no	—
`createdAt`	`string (date-time)`	no	—
`createdByUserId`	`string (uuid)`	no	—
`documentId`	`string (uuid)`	no	—
`expiresAt`	`string (date-time) \| null`	no	—
`id`	`string (uuid)`	no	—
`isExpired`	`boolean`	no	—
`isPublic`	`boolean`	no	—
`isRevoked`	`boolean`	no	—
`isValid`	`boolean`	no	—
`isVersionSpecific`	`boolean`	no	—
`lastAccessedAt`	`string (date-time) \| null`	no	—
`remainingTime`	`string (date-span) \| null`	no	—
`revokedAt`	`string (date-time) \| null`	no	—
`shareToken`	`string \| null`	no	—
`shareUrl`	`string \| null`	no	—
`sharedWithUserId`	`string (uuid) \| null`	no	—
`versionNumber`	`integer (int32) \| null`	no	—

DocumentStatisticsDto

Property	Type	Required	Description
`createdAt`	`string (date-time)`	no	—
`documentId`	`string (uuid)`	no	—
`lastAccessedAt`	`string (date-time) \| null`	no	—
`lastAccessedByUserId`	`string (uuid) \| null`	no	—
`modifiedAt`	`string (date-time)`	no	—
`totalDownloads`	`integer (int32)`	no	—
`totalShares`	`integer (int32)`	no	—
`totalVersions`	`integer (int32)`	no	—
`totalViews`	`integer (int32)`	no	—
`uniqueDownloaders`	`integer (int32)`	no	—
`uniqueViewers`	`integer (int32)`	no	—

DocumentSupersessionResponse

Property	Type	Required	Description
`dependents`	`SupersessionDependentDto[] \| null`	no	—
`hasDependents`	`boolean`	no	—
`replacementDocumentId`	`string (uuid)`	no	—
`supersededAt`	`string (date-time)`	no	—
`supersededDocumentId`	`string (uuid)`	no	—

DocumentVersionDto

Property	Type	Required	Description
`ageInDays`	`integer (int32)`	no	—
`changeDescription`	`string \| null`	no	—
`contentHash`	`string \| null`	no	—
`createdAt`	`string (date-time)`	no	—
`createdByUserId`	`string (uuid)`	no	—
`description`	`string \| null`	no	—
`documentId`	`string (uuid)`	no	—
`encryptionAlgorithm`	`string \| null`	no	—
`fileName`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`isCurrent`	`boolean`	no	—
`keyId`	`string \| null`	no	—
`mimeType`	`string \| null`	no	—
`sizeBytes`	`integer (int64)`	no	—
`tags`	`string[] \| null`	no	—
`versionNumber`	`integer (int32)`	no	—

ElectProxyExclusionRequestDto

Property	Type	Required	Description
`guardianActorId`	`string (uuid) \| null`	no	—

EnrolOrganizationMasterKeyRequest

Property	Type	Required	Description
`holderEnvelopes`	`MasterKeyHolderEnvelopeDto[] \| null`	no	—

EnrolOrganizationRecoveryKitRequest

Property	Type	Required	Description
`scheme`	`string \| null`	no	—
`verifier`	`string \| null`	no	—
`wrappedMasterKey`	`string \| null`	no	—
`wrappedPrivateKey`	`string \| null`	no	—

EstateReleaseAuthorizationResultDto

Property	Type	Required	Description
`changed`	`boolean`	no	—
`estateId`	`string (uuid)`	no	—
`probateGranted`	`boolean`	no	—
`releaseAuthorizedAt`	`string (date-time)`	no	—

EvidenceChainDto

Property	Type	Required	Description
`bound`	`boolean`	no	—
`changeId`	`string (uuid)`	no	—
`deedPollDocumentId`	`string (uuid)`	no	—
`links`	`EvidenceLinkDto[] \| null`	no	—
`names`	`NamePairDto`	no	—

EvidenceLinkDto

Property	Type	Required	Description
`auditAnchor`	`string \| null`	no	—
`citesDeedPollDocumentId`	`string (uuid)`	no	—
`eventId`	`string (uuid)`	no	—
`kind`	`string \| null`	no	—
`label`	`string \| null`	no	—
`occurredAtIso`	`string \| null`	no	—

ExtendShareExpirationCommand

Property	Type	Required	Description
`documentId`	`string (uuid)`	no	—
`newExpiresAt`	`string (date-time)`	no	—
`requestingUserId`	`string (uuid)`	no	—
`shareId`	`string (uuid)`	no	—

FacetValueDto

Property	Type	Required	Description
`count`	`integer (int64)`	no	—
`metadata`	`string \| null`	no	—
`value`	`string \| null`	no	—

FamilyMemberVaultProvisionedDto

Property	Type	Required	Description
`familyPlanReference`	`string \| null`	no	—
`memberUserId`	`string (uuid)`	no	—
`provisionedAt`	`string (date-time)`	no	—
`provisioningId`	`string (uuid)`	no	—
`sponsorUserId`	`string (uuid)`	no	—
`status`	`string \| null`	no	—
`vault`	`VaultDto`	no	—
`vaultId`	`string (uuid)`	no	—

FhirCodingDto

Property	Type	Required	Description
`code`	`string \| null`	no	—
`display`	`string \| null`	no	—
`system`	`string \| null`	no	—

FhirMetadataDto

Property	Type	Required	Description
`codings`	`FhirCodingDto[] \| null`	no	—
`date`	`string (date-time) \| null`	no	—
`profileUrl`	`string \| null`	no	—
`resourceType`	`string \| null`	no	—
`version`	`string \| null`	no	—

FieldContentDto

Property	Type	Required	Description
`algorithmVersion`	`integer (int32)`	no	—
`authTag`	`string \| null`	no	—
`ciphertext`	`string \| null`	no	—
`documentId`	`string (uuid)`	no	—
`fieldId`	`string \| null`	no	—
`iv`	`string \| null`	no	—
`keyGeneration`	`integer (int32)`	no	—
`keyId`	`string \| null`	no	—
`wrappedKey`	`string \| null`	no	—

FieldEnvelopeInput

Property	Type	Required	Description
`algorithmVersion`	`integer (int32)`	no	—
`authTag`	`string \| null`	no	—
`ciphertext`	`string \| null`	no	—
`fieldId`	`string \| null`	no	—
`iv`	`string \| null`	no	—
`keyGeneration`	`integer (int32)`	no	—
`ordinal`	`integer (int32)`	no	—
`searchableValue`	`string \| null`	no	—

FieldShareDto

Property	Type	Required	Description
`accessLevel`	`string \| null`	no	—
`consentId`	`string (uuid) \| null`	no	—
`createdByUserId`	`string (uuid)`	no	—
`crossing`	`string \| null`	no	—
`documentId`	`string (uuid)`	no	—
`expiresAt`	`string (date-time) \| null`	no	—
`fieldId`	`string \| null`	no	—
`grantedAt`	`string (date-time)`	no	—
`id`	`string (uuid)`	no	—
`pendingResolutionDeadline`	`string (date-time) \| null`	no	—
`recipientDisplayName`	`string \| null`	no	—
`recipientHomeRegion`	`string \| null`	no	—
`recipientOrgId`	`string (uuid) \| null`	no	—
`recipientType`	`string \| null`	no	—
`recipientUserId`	`string (uuid) \| null`	no	—
`revokedAt`	`string (date-time) \| null`	no	—
`status`	`string \| null`	no	—
`suspensionGraceWindowEndsAt`	`string (date-time) \| null`	no	—
`vaultHomeRegion`	`string \| null`	no	—

FieldShareDtoPagedResultDto

Property	Type	Required	Description
`hasNextPage`	`boolean`	no	—
`hasPreviousPage`	`boolean`	no	—
`items`	`FieldShareDto[] \| null`	no	—
`pageNumber`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`totalCount`	`integer (int32)`	no	—
`totalPages`	`integer (int32)`	no	—

FieldShareResultItemDto

Property	Type	Required	Description
`errorCode`	`string \| null`	no	—
`fieldId`	`string \| null`	no	—
`share`	`FieldShareDto`	no	—
`succeeded`	`boolean`	no	—

FieldSubscriptionDto

Property	Type	Required	Description
`consentId`	`string (uuid)`	no	—
`createdAt`	`string (date-time)`	no	—
`documentId`	`string (uuid)`	no	—
`fieldId`	`string \| null`	no	—
`maxSyncs`	`integer (int32) \| null`	no	—
`remainingSyncs`	`integer (int32) \| null`	no	—
`status`	`string \| null`	no	—
`subscriberId`	`string (uuid)`	no	—
`subscriberType`	`string \| null`	no	—
`subscriptionId`	`string (uuid)`	no	—
`syncType`	`string \| null`	no	—
`syncsUsed`	`integer (int32)`	no	—
`validFrom`	`string (date-time) \| null`	no	—
`validTo`	`string (date-time) \| null`	no	—

GetDocumentVersionHistoryQueryResult

Property	Type	Required	Description
`currentVersionNumber`	`integer (int32)`	no	—
`pageNumber`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`totalVersions`	`integer (int32)`	no	—
`versions`	`DocumentVersionDto[] \| null`	no	—

GetTemplatesByCategoryQueryResult

Property	Type	Required	Description
`category`	`string \| null`	no	—
`templates`	`TemplateDto[] \| null`	no	—
`totalCount`	`integer (int32)`	no	—

GetTemplatesBySchemaQueryResult

Property	Type	Required	Description
`schemaRef`	`string \| null`	no	—
`templates`	`TemplateDto[] \| null`	no	—
`totalCount`	`integer (int32)`	no	—

GoverningLawCitationDto

Property	Type	Required	Description
`ageOfMajority`	`integer (int32)`	no	—
`citation`	`string \| null`	no	—
`jurisdiction`	`string \| null`	no	—

GrantAccessRequest

Request model for granting vault access.

Property	Type	Required	Description
`expiresAt`	`string (date-time) \| null`	no	Optional expiration date for temporary access
`role`	`VaultRole`	no	—
`userId`	`string (uuid)`	no	ID of the user to grant access to

GuardianProxyViewDto

Property	Type	Required	Description
`categories`	`ProjectedCategoryCountDto[] \| null`	no	—
`guardianActorId`	`string \| null`	no	—
`itemCount`	`integer (int32)`	no	—
`items`	`ProjectedProxyItemDto[] \| null`	no	—
`notifications`	`ProjectedNotificationDto[] \| null`	no	—
`subjectRef`	`string \| null`	no	—
`timeline`	`ProjectedTimelineBucketDto[] \| null`	no	—
`usage`	`ProjectedUsageLineDto[] \| null`	no	—
`usageTotal`	`ProjectedUsageTotalDto`	no	—

GuardianProxyViewInputDto

Property	Type	Required	Description
`guardianActorId`	`string \| null`	no	—
`items`	`ProxyViewItemDto[] \| null`	no	—
`notifications`	`ProxyNotificationDto[] \| null`	no	—
`subjectRef`	`string \| null`	no	—
`usage`	`ProxyUsageLineDto[] \| null`	no	—

GuardianRevocationDto

Property	Type	Required	Description
`guardianUserId`	`string (uuid)`	no	—
`previouslyVisibleSummary`	`string \| null`	no	—
`priorRole`	`string \| null`	no	—
`retainsResidualView`	`boolean`	no	—
`revokedAt`	`string (date-time)`	no	—

GuardianRoleAssignmentDto

Property	Type	Required	Description
`guardianUserId`	`string (uuid)`	no	—
`role`	`string \| null`	no	—

HandoverAuditAnchorDto

Property	Type	Required	Description
`anchorRequestedAt`	`string (date-time)`	no	—
`certificateId`	`string (uuid)`	no	—
`verifyPath`	`string \| null`	no	—

HandoverCertificateDto

Property	Type	Required	Description
`adultUserId`	`string (uuid)`	no	—
`auditAnchor`	`HandoverAuditAnchorDto`	no	—
`childUserId`	`string (uuid)`	no	—
`governingLaw`	`GoverningLawCitationDto`	no	—
`guardianAccessRevokedAt`	`string (date-time)`	no	—
`jurisdiction`	`string \| null`	no	—
`majorityDate`	`string (date)`	no	—
`recordsByClass`	`HandoverRecordClassCountDto[] \| null`	no	—
`recordsTransferred`	`integer (int32)`	no	—
`soleKeyCustodyConfirmed`	`boolean`	no	—
`transitionId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—
`verificationCode`	`string \| null`	no	—

HandoverConfirmationDto

Property	Type	Required	Description
`adultUserId`	`string (uuid)`	no	—
`childUserId`	`string (uuid)`	no	—
`formerGuardians`	`GuardianRevocationDto[] \| null`	no	—
`jurisdiction`	`string \| null`	no	—
`remainingGuardianCount`	`integer (int32)`	no	—
`revokedAt`	`string (date-time)`	no	—
`transitionId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

HandOverContactRequestDto

Property	Type	Required	Description
`closureContext`	`string (uuid) \| null`	no	—
`contactLinkId`	`string (uuid)`	no	—
`contentDigest`	`string \| null`	no	—
`disposition`	`string \| null`	no	—
`recoveryWindowDays`	`integer (int32) \| null`	no	—
`vaultId`	`string (uuid)`	no	—

HandoverReceiptDto

Property	Type	Required	Description
`attestation`	`CompletenessAttestationDto`	no	—
`forwardResponsibilityFrom`	`string (date)`	no	—
`liabilityEndsOn`	`string (date)`	no	—
`newKeeperName`	`string \| null`	no	—
`priorKeeperName`	`string \| null`	no	—
`registryNextStep`	`RegistryNextStepDto`	no	—
`scope`	`HandoverScopeDto`	no	—
`subjectName`	`string \| null`	no	—
`transferredOn`	`string (date)`	no	—
`verdict`	`string \| null`	no	—

HandoverRecordClassCountDto

Property	Type	Required	Description
`count`	`integer (int32)`	no	—
`recordClass`	`string \| null`	no	—

HandoverScopeDto

Property	Type	Required	Description
`complete`	`boolean`	no	—
`notIncluded`	`RecordSetDto[] \| null`	no	—
`transferred`	`RecordSetDto[] \| null`	no	—

HeldSubjectDto

Property	Type	Required	Description
`acquiredByKeeperChangeId`	`string (uuid) \| null`	no	—
`heldSince`	`string (date-time)`	no	—
`id`	`string (uuid)`	no	—
`kind`	`string \| null`	no	—
`name`	`string \| null`	no	—
`species`	`string \| null`	no	—

HouseholdContactVaultContainerDto

Property	Type	Required	Description
`activeContactCount`	`integer (int32)`	no	—
`containerId`	`string (uuid)`	no	—
`createdByUserId`	`string (uuid)`	no	—
`householdId`	`string (uuid)`	no	—
`provisionedAt`	`string (date-time)`	no	—
`status`	`string \| null`	no	—

HouseholdContactVaultEntryDto

Property	Type	Required	Description
`addedAt`	`string (date-time)`	no	—
`authenticationTag`	`string \| null`	no	—
`ciphertext`	`string \| null`	no	—
`contactRef`	`string \| null`	no	—
`containerId`	`string (uuid)`	no	—
`contributorUserId`	`string (uuid)`	no	—
`entryId`	`string (uuid)`	no	—
`initializationVector`	`string \| null`	no	—
`keyId`	`string \| null`	no	—
`poolMode`	`string \| null`	no	—
`status`	`string \| null`	no	—

ImportCustodialRecordRequestDto

Property	Type	Required	Description
`encryptedContent`	`string (byte) \| null`	no	—
`fileName`	`string \| null`	no	—
`keyId`	`string \| null`	no	—
`mimeType`	`string \| null`	no	—
`sensitivityLabel`	`string \| null`	no	—
`sourceItemId`	`string \| null`	no	—
`supersedesSourceItemIds`	`string[] \| null`	no	—

InitiateKeeperChangeRecordSet

Full descriptor for a handed-over record set on the initiate request.

Property	Type	Required	Description
`itemCount`	`integer (int32) \| null`	no	Number of items in the set (0 when unknown at handover time).
`kind`	`string \| null`	no	Coarse kind (kebab-case): microchip-registration, vaccination-clinical, full-clinical.
`label`	`string \| null`	no	Human label, e.g. "Vaccination & clinical history".
`setId`	`string \| null`	no	Stable identifier of the record set.

InitiateKeeperChangeRequest

Request body for `POST /api/v1/keeper-changes`. Matches the essence-web `InitiateKeeperChangeRequest` client contract, enriched with the optional full record-set descriptors so the server can render the keep-vs-pass honestly.

Property	Type	Required	Description
`newKeeperHandle`	`string \| null`	no	Handle/email of the new keeper who must accept.
`newKeeperName`	`string \| null`	no	Display name of the new keeper (optional; defaults to the handle).
`passingRecordSetIds`	`string[] \| null`	no	Ids of the record sets that pass to the new keeper (minimal client contract).
`recipientKind`	`string \| null`	no	Whether the new keeper already holds an Essence account (`essence-user`, default) or must be invited by email (`email-invite`) — debt-2026-08-10-086. The essence-web client has always sent this; it is now persisted, and an `email-invite` handover issues the single-use invite token the emailed link carries.
`recordSets`	`InitiateKeeperChangeRecordSet[] \| null`	no	Full record-set descriptors (preferred; enables an honest keep-vs-pass DTO).
`retention`	`string \| null`	no	Retention statement to bind onto the handover consent.
`subjectId`	`string (uuid)`	no	The dependent, non-human subject being rehomed.
`subjectName`	`string \| null`	no	Display name of the subject.

InitiateUploadCommand

Property	Type	Required	Description
`chunkSize`	`integer (int32) \| null`	no	—
`contentType`	`string \| null`	no	—
`fileHash`	`string \| null`	no	—
`fileName`	`string \| null`	no	—
`fileSize`	`integer (int64)`	no	—
`userId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

InitiateUploadCommandResult

Property	Type	Required	Description
`chunkSize`	`integer (int32)`	no	—
`duplicateDetected`	`boolean`	no	—
`existingDocumentId`	`string (uuid) \| null`	no	—
`expiresAt`	`string (date-time)`	no	—
`sessionId`	`string (uuid)`	no	—
`totalChunks`	`integer (int32)`	no	—

InjectTargetedDocumentCommand

Property	Type	Required	Description
`consentReference`	`string \| null`	no	—
`expiresAt`	`string (date-time) \| null`	no	—
`injectedDocumentId`	`string (uuid)`	no	—
`privacyTermsJson`	`string \| null`	no	—
`requesterId`	`string (uuid)`	no	—
`requesterType`	`string \| null`	no	—
`targetUserId`	`string (uuid)`	no	—

InjectUnmatchedDocumentCommand

Property	Type	Required	Description
`expiresAt`	`string (date-time) \| null`	no	—
`injectedDocumentId`	`string (uuid)`	no	—
`matchHintHash`	`string \| null`	no	—
`privacyTermsJson`	`string \| null`	no	—
`requesterId`	`string (uuid)`	no	—
`requesterType`	`string \| null`	no	—

IssuedCredentialDepositRequestDto

Property	Type	Required	Description
`credentialId`	`string (uuid)`	no	—
`encryptedContent`	`string (byte) \| null`	no	—
`issuerId`	`string (uuid)`	no	—
`keyId`	`string \| null`	no	—

IssuedCredentialDepositResultDto

Property	Type	Required	Description
`created`	`boolean`	no	—
`documentId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

KeeperChangeDto

Property	Type	Required	Description
`consent`	`RecordsHandoverConsentDto`	no	—
`facilitator`	`KeeperChangeFacilitatorDto`	no	—
`id`	`string (uuid)`	no	—
`inviteVerified`	`boolean`	no	—
`newKeeperName`	`string \| null`	no	—
`passing`	`KeeperChangePassingDto`	no	—
`priorKeeperName`	`string \| null`	no	—
`receipt`	`HandoverReceiptDto`	no	—
`recipientKind`	`string \| null`	no	—
`retained`	`KeeperChangeRetainedDto`	no	—
`status`	`string \| null`	no	—
`subjectId`	`string (uuid)`	no	—
`subjectName`	`string \| null`	no	—

KeeperChangeFacilitatorDto

Property	Type	Required	Description
`organisationId`	`string (uuid)`	no	—
`organisationName`	`string \| null`	no	—

KeeperChangeInviteRequest

Request body for the anonymous invite endpoints (`POST /api/v1/keeper-changes/{id}/invite/{verify|accept|decline}`). Matches the essence-web `VerifyHandoverInviteRequest` client type.

Property	Type	Required	Description
`email`	`string \| null`	no	The address the invitee says the invite was sent to.
`inviteToken`	`string \| null`	no	Single-use invite token from the emailed link.

KeeperChangePassingDto

Property	Type	Required	Description
`forwardResponsibility`	`boolean`	no	—
`recordSets`	`RecordSetDto[] \| null`	no	—

KeeperChangePolicyDto

Property	Type	Required	Description
`recommendedSetIds`	`string[] \| null`	no	—
`recordSets`	`RecordSetDto[] \| null`	no	—
`retention`	`string \| null`	no	—
`retentionReviewMonths`	`integer (int32) \| null`	no	—

KeeperChangeRetainedDto

Property	Type	Required	Description
`handoverReceipt`	`boolean`	no	—
`historicalRecordSets`	`RecordSetDto[] \| null`	no	—

KeeperChangeStandingDto

Property	Type	Required	Description
`awaitingMyDecision`	`KeeperChangeDto[] \| null`	no	—
`sent`	`KeeperChangeDto[] \| null`	no	—

ListDeletedDocumentsQueryResult

Property	Type	Required	Description
`items`	`TrashedDocumentDto[] \| null`	no	—
`pageNumber`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`recoveryWindowDays`	`integer (int32)`	no	—
`totalCount`	`integer (int32)`	no	—

ListTemplatesQueryResult

Property	Type	Required	Description
`pageNumber`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`templates`	`TemplateDto[] \| null`	no	—
`totalCount`	`integer (int32)`	no	—
`totalPages`	`integer (int32)`	no	—

MasterKeyHolderEnvelopeDto

Property	Type	Required	Description
`holderUserId`	`string (uuid)`	no	—
`wrappedMasterKey`	`string \| null`	no	—

MeasureModuleRecordExportRequestDto

Property	Type	Required	Description
`moduleId`	`string (uuid)`	no	—
`schemaRefs`	`string[] \| null`	no	—
`switchId`	`string (uuid) \| null`	no	—

MediatedCredentialBodyDto

The opened body: the client-sealed ciphertext, base64-encoded.

Property	Type	Required	Description
`credentialRef`	`string \| null`	no	—
`payloadBase64`	`string \| null`	no	—

MediatedCredentialDescriptorDto

Descriptor projection — refs, type and claim NAMES only (FR-PMD.003).

Property	Type	Required	Description
`claimNames`	`string[] \| null`	no	—
`credentialFormat`	`string \| null`	no	—
`credentialRef`	`string \| null`	no	—
`credentialType`	`string \| null`	no	—
`issuerRef`	`string \| null`	no	—
`statusRef`	`string \| null`	no	—
`supportsCryptographicSelectiveDisclosure`	`boolean`	no	—

MediatedDescriptorsRequestDto

Request body for `POST api/v1/vault/mediated-access/descriptors`.

Property	Type	Required	Description
`decisionId`	`string (uuid)`	no	—
`proofBase64`	`string \| null`	no	—
`subjectRef`	`string \| null`	no	—

MediatedSigningDispatchDto

Signing dispatch outcome — for the vault store, always an honest refusal.

Property	Type	Required	Description
`dispatched`	`boolean`	no	—
`failureReason`	`string \| null`	no	—

MediatedSigningRequestDto

Request body for `POST api/v1/vault/mediated-access/signing`.

Property	Type	Required	Description
`decisionId`	`string (uuid)`	no	—
`keyRef`	`string \| null`	no	—
`payloadBase64`	`string \| null`	no	—
`proofBase64`	`string \| null`	no	—

MemberCustodyKeyDto

Property	Type	Required	Description
`custodyKeyId`	`string \| null`	no	—
`depositedAt`	`string (date-time) \| null`	no	—
`sealedKey`	`string (byte) \| null`	no	—
`sealedToKeyId`	`string \| null`	no	—
`state`	`string \| null`	no	—

MemberCustodyKeysDto

Property	Type	Required	Description
`keys`	`MemberCustodyKeyDto[] \| null`	no	—
`memberOrganizationId`	`string (uuid)`	no	—
`state`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

MergeConflictItemDto

Property	Type	Required	Description
`categoryId`	`string (uuid) \| null`	no	—
`categoryName`	`string \| null`	no	—
`fileName`	`string \| null`	no	—
`isCritical`	`boolean`	no	—
`resolutionDecision`	`string \| null`	no	—
`sourceDocumentId`	`string (uuid)`	no	—

MergeConflictQueueDto

Property	Type	Required	Description
`autoResolvedCount`	`integer (int32)`	no	—
`conflicts`	`MergeConflictQueueItemDto[] \| null`	no	—
`mergeId`	`string (uuid)`	no	—
`unreadableCount`	`integer (int32)`	no	—

MergeConflictQueueItemDto

Property	Type	Required	Description
`accountA`	`string \| null`	no	—
`accountB`	`string \| null`	no	—
`id`	`string \| null`	no	—
`kind`	`string \| null`	no	—
`label`	`string \| null`	no	—
`severity`	`string \| null`	no	—
`similarKey`	`string \| null`	no	—

MergeConflictsDto

Property	Type	Required	Description
`autoResolved`	`MergeConflictItemDto[] \| null`	no	—
`critical`	`MergeConflictItemDto[] \| null`	no	—
`domain`	`string \| null`	no	—
`mergeId`	`string (uuid)`	no	—

MergeConsentOutcomeRowDto

Property	Type	Required	Description
`id`	`string \| null`	no	—
`label`	`string \| null`	no	—
`outcome`	`string \| null`	no	—
`party`	`string \| null`	no	—

MergeConsentSummaryDto

Property	Type	Required	Description
`affected`	`integer (int32)`	no	—
`carried`	`integer (int32)`	no	—
`dropped`	`integer (int32)`	no	—
`reconfirm`	`integer (int32)`	no	—
`suspended`	`integer (int32)`	no	—

MergeContactDedupRowDto

Property	Type	Required	Description
`id`	`string \| null`	no	—
`kind`	`string \| null`	no	—
`label`	`string \| null`	no	—

MergeContactSummaryDto

Property	Type	Required	Description
`affected`	`integer (int32)`	no	—
`duplicatesMerged`	`integer (int32)`	no	—

MergeDocumentSummaryDto

Property	Type	Required	Description
`affected`	`integer (int32)`	no	—
`conflicts`	`integer (int32)`	no	—
`duplicates`	`integer (int32)`	no	—
`unreadable`	`integer (int32)`	no	—

MergeItemOutcomeDto

Property	Type	Required	Description
`classification`	`string \| null`	no	—
`outcome`	`string \| null`	no	—
`sourceDocumentId`	`string (uuid)`	no	—

MergeResolutionChoiceDto

Property	Type	Required	Description
`choice`	`string \| null`	no	—
`conflictId`	`string \| null`	no	—

MergeSummaryDto

Property	Type	Required	Description
`consents`	`MergeConsentOutcomeRowDto[] \| null`	no	—
`contacts`	`MergeContactDedupRowDto[] \| null`	no	—
`mergeId`	`string (uuid)`	no	—
`summary`	`MergeSummaryFiguresDto`	no	—

MergeSummaryFiguresDto

Property	Type	Required	Description
`consents`	`MergeConsentSummaryDto`	no	—
`contacts`	`MergeContactSummaryDto`	no	—
`documents`	`MergeDocumentSummaryDto`	no	—

MigrationDocumentLoadRequestDto

Property	Type	Required	Description
`encryptedContent`	`string (byte) \| null`	no	—
`fileName`	`string \| null`	no	—
`jobId`	`string (uuid)`	no	—
`keyId`	`string \| null`	no	—
`mimeType`	`string \| null`	no	—
`recordKey`	`string \| null`	no	—
`sensitivityLabel`	`string \| null`	no	—

MigrationDocumentLoadResultDto

Property	Type	Required	Description
`created`	`boolean`	no	—
`documentId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

ModuleRecordExportDto

Property	Type	Required	Description
`documentSetDigest`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`listedCount`	`integer (int32)`	no	—
`measuredAt`	`string (date-time)`	no	—
`moduleId`	`string (uuid)`	no	—
`organizationId`	`string (uuid)`	no	—
`recordCount`	`integer (int32)`	no	—
`requestedBy`	`string (uuid)`	no	—
`schemaRefs`	`string[] \| null`	no	—
`switchId`	`string (uuid) \| null`	no	—
`unreachableCount`	`integer (int32)`	no	—

ModuleRecordExportItemDto

Property	Type	Required	Description
`contentHash`	`string \| null`	no	—
`documentId`	`string (uuid)`	no	—
`documentVersion`	`integer (int32)`	no	—
`schemaRef`	`string \| null`	no	—
`schemaVersion`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

ModuleRecordExportItemDtoCursorResult

Property	Type	Required	Description
`hasMore`	`boolean`	no	—
`items`	`ModuleRecordExportItemDto[] \| null`	no	—
`nextCursor`	`string \| null`	no	—
`pageSize`	`integer (int32)`	no	—
`previousCursor`	`string \| null`	no	—

MoveCategoryCommand

Property	Type	Required	Description
`categoryId`	`string (uuid)`	no	—
`newParentCategoryId`	`string (uuid) \| null`	no	—
`requestingUserId`	`string (uuid)`	no	—

NamePairDto

Property	Type	Required	Description
`newName`	`string \| null`	no	—
`newNameMasked`	`string \| null`	no	—
`previousName`	`string \| null`	no	—
`previousNameMasked`	`string \| null`	no	—

NewbornSeedRecordDto

Property	Type	Required	Description
`attachedAt`	`string (date-time) \| null`	no	—
`attachedDocumentId`	`string (uuid) \| null`	no	—
`sourceRecordId`	`string \| null`	no	—

NewbornVaultProvisioningDto

Property	Type	Required	Description
`episodeId`	`string (uuid)`	no	—
`graduationDate`	`string (date) \| null`	no	—
`inheritedShareCount`	`integer (int32)`	no	—
`inheritedSharesVerifiedAt`	`string (date-time) \| null`	no	—
`jurisdiction`	`string \| null`	no	—
`motherUserId`	`string (uuid)`	no	—
`newbornUserId`	`string (uuid)`	no	—
`provisionedAt`	`string (date-time) \| null`	no	—
`provisioningAuditReference`	`string \| null`	no	—
`seedRecords`	`NewbornSeedRecordDto[] \| null`	no	—
`status`	`string \| null`	no	—
`supervisedProvisioningId`	`string (uuid) \| null`	no	—
`vaultId`	`string (uuid) \| null`	no	—

OpenMediatedCredentialRequestDto

Request body for `POST api/v1/vault/mediated-access/open`.

Property	Type	Required	Description
`credentialRef`	`string \| null`	no	—
`decisionId`	`string (uuid)`	no	—
`proofBase64`	`string \| null`	no	—

OrganizationConsentLedger

Property	Type	Required	Description
`counterparties`	`CounterpartyConsentLedgerRow[] \| null`	no	—
`counterpartyOrganizations`	`CounterpartyOrganizationConsentLedgerRow[] \| null`	no	—
`summary`	`OrganizationConsentLedgerSummary`	no	—

OrganizationConsentLedgerSummary

Property	Type	Required	Description
`expiringWithin30Days`	`integer (int32)`	no	—
`fieldsHeld`	`integer (int32)`	no	—
`liveConsents`	`integer (int32)`	no	—

OrganizationKeyHolderEnvelopeDto

Property	Type	Required	Description
`holderUserId`	`string (uuid)`	no	—
`organizationId`	`string (uuid)`	no	—
`status`	`string \| null`	no	—
`wrappedByUserId`	`string (uuid)`	no	—
`wrappedMasterKey`	`string \| null`	no	—
`wrappedPrivateKey`	`string \| null`	no	—

OrganizationKeyHoldersDto

Property	Type	Required	Description
`holderUserIds`	`(string (uuid))[] \| null`	no	—
`organizationId`	`string (uuid)`	no	—

OrganizationKeyPairSummaryDto

Property	Type	Required	Description
`activeKeyHolderCount`	`integer (int32)`	no	—
`algorithm`	`string \| null`	no	—
`hasMasterKey`	`boolean`	no	—
`masterKeyGeneration`	`integer (int32)`	no	—
`organizationId`	`string (uuid)`	no	—
`status`	`string \| null`	no	—

OrganizationPublicKeyDto

Property	Type	Required	Description
`algorithm`	`string \| null`	no	—
`organizationId`	`string (uuid)`	no	—
`publicKey`	`string \| null`	no	—
`status`	`string \| null`	no	—

OrganizationRecoveryKitEnvelopeDto

Property	Type	Required	Description
`algorithm`	`string \| null`	no	—
`masterKeyGeneration`	`integer (int32)`	no	—
`organizationId`	`string (uuid)`	no	—
`publicKey`	`string \| null`	no	—
`scheme`	`string \| null`	no	—
`wrappedMasterKey`	`string \| null`	no	—
`wrappedPrivateKey`	`string \| null`	no	—

OrganizationRecoveryKitStatusDto

Property	Type	Required	Description
`callerIsKeyHolder`	`boolean`	no	—
`enroledAt`	`string (date-time) \| null`	no	—
`enroledByUserId`	`string (uuid) \| null`	no	—
`enrolled`	`boolean`	no	—
`lastClaimedAt`	`string (date-time) \| null`	no	—
`lastClaimedByUserId`	`string (uuid) \| null`	no	—
`masterKeyGeneration`	`integer (int32)`	no	—
`organizationId`	`string (uuid)`	no	—
`scheme`	`string \| null`	no	—

OrganizationSealedDocumentContentDto

Property	Type	Required	Description
`ciphertext`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`keyId`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

OrganizationSealedDocumentDto

Property	Type	Required	Description
`fileName`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`keyId`	`string \| null`	no	—
`mimeType`	`string \| null`	no	—
`sensitivityLabel`	`string \| null`	no	—
`sizeBytes`	`integer (int64)`	no	—
`statusOnly`	`boolean`	no	—
`tags`	`string[] \| null`	no	—
`vaultId`	`string (uuid)`	no	—

OrganizationSealedDocumentDtoCursorResult

Property	Type	Required	Description
`hasMore`	`boolean`	no	—
`items`	`OrganizationSealedDocumentDto[] \| null`	no	—
`nextCursor`	`string \| null`	no	—
`pageSize`	`integer (int32)`	no	—
`previousCursor`	`string \| null`	no	—

OrganizationVaultCountDto

Property	Type	Required	Description
`organizationId`	`string (uuid)`	no	—
`vaultCount`	`integer (int32)`	no	—

PendingSponsoredEntitlementDto

Property	Type	Required	Description
`createdAt`	`string (date-time)`	no	—
`currentPlan`	`string \| null`	no	—
`decidedAt`	`string (date-time) \| null`	no	—
`expiresAt`	`string (date-time) \| null`	no	—
`id`	`string (uuid)`	no	—
`isActionable`	`boolean`	no	—
`offeredPlan`	`string \| null`	no	—
`sponsorDisplayName`	`string \| null`	no	—
`sponsorId`	`string (uuid)`	no	—
`sponsorReference`	`string \| null`	no	—
`status`	`string \| null`	no	—

PoolHouseholdContactRequestDto

Property	Type	Required	Description
`authenticationTag`	`string \| null`	no	—
`ciphertext`	`string \| null`	no	—
`contactRef`	`string \| null`	no	—
`initializationVector`	`string \| null`	no	—
`keyId`	`string \| null`	no	—
`poolMode`	`string \| null`	no	—

PrepareReconciliationRequestDto

Property	Type	Required	Description
`candidates`	`ReconciliationCandidateDto[] \| null`	no	—
`matchDecision`	`string \| null`	no	—
`originJurisdiction`	`string \| null`	no	—

PreviewVaultMergeRequestDto

Property	Type	Required	Description
`sourceVaultId`	`string (uuid)`	no	—
`targetVaultId`	`string (uuid)`	no	—

PriorGuardianSeveranceDto

Property	Type	Required	Description
`accessEndedAt`	`string (date-time) \| null`	no	—
`guardianUserId`	`string (uuid)`	no	—
`retainedUnderNewOrder`	`boolean`	no	—
`role`	`string \| null`	no	—

ProblemDetails

Property	Type	Required	Description
`detail`	`string \| null`	no	—
`instance`	`string \| null`	no	—
`status`	`integer (int32) \| null`	no	—
`title`	`string \| null`	no	—
`type`	`string \| null`	no	—

ProgrammeRecordsHandOverDto

Property	Type	Required	Description
`message`	`string \| null`	no	—
`recordsSecured`	`integer (int32)`	no	—
`recordsTotal`	`integer (int32)`	no	—
`stage`	`string \| null`	no	—

ProjectedCategoryCountDto

Property	Type	Required	Description
`category`	`string \| null`	no	—
`count`	`integer (int32)`	no	—

ProjectedNotificationDto

Property	Type	Required	Description
`notificationRef`	`string \| null`	no	—
`occurredAt`	`string \| null`	no	—
`summary`	`string \| null`	no	—

ProjectedProxyItemDto

Property	Type	Required	Description
`category`	`string \| null`	no	—
`itemRef`	`string \| null`	no	—
`occurredAt`	`string \| null`	no	—
`position`	`integer (int32)`	no	—

ProjectedTimelineBucketDto

Property	Type	Required	Description
`count`	`integer (int32)`	no	—
`periodKey`	`string \| null`	no	—

ProjectedUsageLineDto

Property	Type	Required	Description
`amountMinorUnits`	`integer (int64)`	no	—
`lineRef`	`string \| null`	no	—
`sku`	`string \| null`	no	—
`units`	`integer (int64)`	no	—

ProjectedUsageTotalDto

Property	Type	Required	Description
`amountMinorUnits`	`integer (int64)`	no	—
`units`	`integer (int64)`	no	—

ProvisionAttorneyScopeRequestDto

Property	Type	Required	Description
`attorneyUserId`	`string (uuid)`	no	—
`authorityRecordId`	`string (uuid)`	no	—
`expiresAt`	`string (date-time)`	no	—
`scopedCategories`	`string[] \| null`	no	—
`scopedDocumentIds`	`(string (uuid))[] \| null`	no	—
`scopedFieldIds`	`string[] \| null`	no	—
`vaultId`	`string (uuid)`	no	—

ProvisionFamilyMemberVaultRequestDto

Property	Type	Required	Description
`authenticationTag`	`string \| null`	no	—
`familyPlanReference`	`string \| null`	no	—
`initializationVector`	`string \| null`	no	—
`keyId`	`string \| null`	no	—
`maxStorageSizeBytes`	`integer (int64) \| null`	no	—
`memberUserId`	`string (uuid)`	no	—
`salt`	`string \| null`	no	—
`vaultName`	`string \| null`	no	—

ProvisionHouseholdContainerRequestDto

Property	Type	Required	Description
`householdId`	`string (uuid)`	no	—

ProvisionMinorVaultRequestDto

Property	Type	Required	Description
`authenticationTag`	`string \| null`	no	—
`custodyOrderReference`	`string \| null`	no	—
`graduationDate`	`string (date)`	no	—
`guardians`	`GuardianRoleAssignmentDto[] \| null`	no	—
`initializationVector`	`string \| null`	no	—
`jurisdiction`	`string \| null`	no	—
`keyId`	`string \| null`	no	—
`minorUserId`	`string (uuid)`	no	—
`salt`	`string \| null`	no	—
`vaultName`	`string \| null`	no	—

ProvisionNewbornVaultRequestDto

Property	Type	Required	Description
`authenticationTag`	`string \| null`	no	—
`graduationDate`	`string (date)`	no	—
`initializationVector`	`string \| null`	no	—
`jurisdiction`	`string \| null`	no	—
`keyId`	`string \| null`	no	—
`salt`	`string \| null`	no	—
`vaultName`	`string \| null`	no	—

ProvisionOrganizationKeyPairRequest

Property	Type	Required	Description
`algorithm`	`string \| null`	no	—
`founderWrappedMasterKey`	`string \| null`	no	—
`founderWrappedPrivateKey`	`string \| null`	no	—
`publicKey`	`string \| null`	no	—

ProxyExclusionDto

Property	Type	Required	Description
`electedAt`	`string (date-time)`	no	—
`exclusionId`	`string (uuid)`	no	—
`guardianActorId`	`string (uuid) \| null`	no	—
`itemRef`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

ProxyNotificationDto

Property	Type	Required	Description
`itemRef`	`string \| null`	no	—
`notificationRef`	`string \| null`	no	—
`occurredAt`	`string \| null`	no	—
`summary`	`string \| null`	no	—

ProxyUsageLineDto

Property	Type	Required	Description
`amountMinorUnits`	`integer (int64)`	no	—
`itemRef`	`string \| null`	no	—
`lineRef`	`string \| null`	no	—
`sku`	`string \| null`	no	—
`units`	`integer (int64)`	no	—

ProxyViewItemDto

Property	Type	Required	Description
`category`	`string \| null`	no	—
`excluded`	`boolean`	no	—
`itemRef`	`string \| null`	no	—
`occurredAt`	`string \| null`	no	—

PublicDocumentShareDto

Property	Type	Required	Description
`accessLevel`	`string \| null`	no	—
`canEdit`	`boolean`	no	—
`documentId`	`string (uuid)`	no	—
`expiresAt`	`string (date-time) \| null`	no	—
`isExpired`	`boolean`	no	—
`isPublic`	`boolean`	no	—
`isRevoked`	`boolean`	no	—
`isValid`	`boolean`	no	—
`isVersionSpecific`	`boolean`	no	—
`remainingTime`	`string (date-span) \| null`	no	—
`versionNumber`	`integer (int32) \| null`	no	—

PublishMemberAccountKeyRequestDto

Property	Type	Required	Description
`algorithm`	`string \| null`	no	—
`publicKey`	`string \| null`	no	—
`wrappedMasterKey`	`string \| null`	no	—
`wrappedPrivateKey`	`string \| null`	no	—

RaiseReconciliationDisputeRequestDto

Property	Type	Required	Description
`detail`	`string \| null`	no	—
`reason`	`string \| null`	no	—
`stage`	`string \| null`	no	—

RebindSplitContainersRequestDto

Property	Type	Required	Description
`containerIds`	`(string (uuid))[] \| null`	no	—

RebindSplitContainersResultDto

Property	Type	Required	Description
`outcomes`	`SplitContainerRebindOutcomeDto[] \| null`	no	—
`rebind`	`VaultSplitRebindDto`	no	—

ReconciliationCandidateDto

Property	Type	Required	Description
`alreadyPresentByContentHash`	`boolean`	no	—
`classification`	`string \| null`	no	—
`contentHash`	`string \| null`	no	—
`residencyLockedToOrigin`	`boolean`	no	—

ReconciliationDisputeDto

Property	Type	Required	Description
`caseRef`	`string \| null`	no	—
`chainedToSignatureValue`	`string \| null`	no	—
`disposedAt`	`string (date-time) \| null`	no	—
`dispositionNote`	`string \| null`	no	—
`intakeId`	`string (uuid)`	no	—
`nextStep`	`string \| null`	no	—
`raisedAt`	`string (date-time)`	no	—
`reason`	`string \| null`	no	—
`reconciliationStatus`	`string \| null`	no	—
`stage`	`string \| null`	no	—
`status`	`string \| null`	no	—

ReconciliationDisputeQueueItemDto

Property	Type	Required	Description
`carryOverCount`	`integer (int32)`	no	—
`confirmedAt`	`string (date-time) \| null`	no	—
`deduplicatedCount`	`integer (int32)`	no	—
`detail`	`string \| null`	no	—
`disputeId`	`string (uuid)`	no	—
`disputeWindowClosesAt`	`string (date-time) \| null`	no	—
`intakeId`	`string (uuid)`	no	—
`leftBehindCount`	`integer (int32)`	no	—
`originJurisdiction`	`string \| null`	no	—
`raisedAt`	`string (date-time)`	no	—
`reason`	`string \| null`	no	—
`reconciliationId`	`string (uuid)`	no	—
`reconciliationStatus`	`string \| null`	no	—
`returningUserId`	`string (uuid)`	no	—
`stage`	`string \| null`	no	—

ReconciliationItemDto

Property	Type	Required	Description
`alreadyPresentByContentHash`	`boolean`	no	—
`classification`	`string \| null`	no	—
`compensatedAt`	`string (date-time) \| null`	no	—
`compensatingDisposition`	`string \| null`	no	—
`contentHash`	`string \| null`	no	—
`disposition`	`string \| null`	no	—
`finalDisposition`	`string \| null`	no	—
`itemId`	`string (uuid)`	no	—
`originJurisdictionDisposition`	`string \| null`	no	—
`residencyLockedToOrigin`	`boolean`	no	—

ReconciliationSignatureDto

Property	Type	Required	Description
`algorithm`	`string \| null`	no	—
`keyId`	`string \| null`	no	—
`signedAt`	`string (date-time)`	no	—
`value`	`string \| null`	no	—

RecordDelegatedWriteRequestDto

Property	Type	Required	Description
`delegationGrantId`	`string (uuid) \| null`	no	—
`justification`	`string \| null`	no	—
`operation`	`string \| null`	no	—
`principalUserId`	`string (uuid)`	no	—
`resourceId`	`string (uuid)`	no	—
`resourceType`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

RecordImportSealRequestDto

Property	Type	Required	Description
`algorithmLabel`	`string \| null`	no	—
`encryptedRecordCount`	`integer (int32)`	no	—
`sealReceiptHash`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

RecordSetDto

Property	Type	Required	Description
`itemCount`	`integer (int32) \| null`	no	—
`kind`	`string \| null`	no	—
`label`	`string \| null`	no	—
`setId`	`string \| null`	no	—

RecordsHandoverConsentDto

Property	Type	Required	Description
`disclosureRecordId`	`string (uuid) \| null`	no	—
`lawfulBasis`	`string \| null`	no	—
`purpose`	`string \| null`	no	—
`retention`	`string \| null`	no	—
`retentionReviewMonths`	`integer (int32) \| null`	no	—
`status`	`string \| null`	no	—
`vetContinuedAccess`	`VetContinuedAccessDto`	no	—

RectificationNoticeDto

Property	Type	Required	Description
`committedAt`	`string (date-time)`	no	—
`completedAt`	`string (date-time) \| null`	no	—
`id`	`string (uuid)`	no	—
`receivedAt`	`string (date-time)`	no	—
`recipientCompleteness`	`string \| null`	no	—
`recipientCount`	`integer (int32) \| null`	no	—
`recordHeldHere`	`boolean \| null`	no	—
`recordId`	`string (uuid) \| null`	no	—
`rectificationId`	`string (uuid)`	no	—
`status`	`string \| null`	no	—

RedeemGrantCertificateRequest

Property	Type	Required	Description
`certificate`	`string \| null`	no	The compact RS256 certificate Essence issued to the claimant when they completed their claim.

RedeemGrantCertificateResponse

Property	Type	Required	Description
`organizationId`	`string (uuid)`	no	The organisation this instance may now mint keys for.

RegisterCustodialKeyRequestDto

Property	Type	Required	Description
`publicKey`	`string \| null`	no	—

RegisterDerivedShareRevocationBatchCommand

Property	Type	Required	Description
`batchId`	`string (uuid)`	no	—
`consentIds`	`(string (uuid))[] \| null`	no	—
`ownerUserId`	`string (uuid)`	no	—

RegisterHeldSubjectRequest

Property	Type	Required	Description
`kind`	`string \| null`	no	—
`name`	`string \| null`	no	—
`species`	`string \| null`	no	—

RegisterPendingSponsoredEntitlementCommand

Property	Type	Required	Description
`currentPlan`	`string \| null`	no	—
`expiresAt`	`string (date-time) \| null`	no	—
`offeredPlan`	`string \| null`	no	—
`ownerUserId`	`string (uuid)`	no	—
`sponsorDisplayName`	`string \| null`	no	—
`sponsorId`	`string (uuid)`	no	—
`sponsorReference`	`string \| null`	no	—

RegisterSensitiveRoleKeyRequestDto

Property	Type	Required	Description
`publicKey`	`string \| null`	no	—

RegistryNextStepDto

Property	Type	Required	Description
`reason`	`string \| null`	no	—
`registryName`	`string \| null`	no	—

RelyingPartyCoverageDto

Property	Type	Required	Description
`inGraceWindow`	`integer (int32)`	no	—
`onNewName`	`integer (int32)`	no	—
`onOldName`	`integer (int32)`	no	—

RenewalDocumentEnvelopesDto

Property	Type	Required	Description
`documentId`	`string (uuid)`	no	—
`fields`	`RenewalFieldEnvelopeDto[] \| null`	no	—

RenewalFieldEnvelopeDto

Property	Type	Required	Description
`algorithmVersion`	`integer (int32)`	no	—
`authTag`	`string \| null`	no	—
`ciphertext`	`string \| null`	no	—
`fieldId`	`string \| null`	no	—
`iv`	`string \| null`	no	—
`keyGeneration`	`integer (int32)`	no	—
`ordinal`	`integer (int32)`	no	—

RenewalFieldEnvelopesDto

Property	Type	Required	Description
`addedFieldIds`	`string[] \| null`	no	—
`comparableFieldIds`	`string[] \| null`	no	—
`previous`	`RenewalDocumentEnvelopesDto`	no	—
`removedFieldIds`	`string[] \| null`	no	—
`replacement`	`RenewalDocumentEnvelopesDto`	no	—

ReplaceDocumentContentRequestDto

Property	Type	Required	Description
`algorithmVersion`	`integer (int32)`	no	—
`authenticationTag`	`string \| null`	no	—
`changeDescription`	`string \| null`	no	—
`contentHash`	`string \| null`	no	—
`description`	`string \| null`	no	—
`encryptedContent`	`string (byte) \| null`	no	—
`expectedRowVersion`	`string \| null`	no	—
`fields`	`ReplaceDocumentFieldEnvelopeDto[] \| null`	no	—
`fileName`	`string \| null`	no	—
`initializationVector`	`string \| null`	no	—
`keyDerivationFunction`	`string \| null`	no	—
`keyGeneration`	`integer (int32)`	no	—
`keyId`	`string \| null`	no	—
`mimeType`	`string \| null`	no	—
`salt`	`string \| null`	no	—
`schemaRef`	`string \| null`	no	—
`schemaVersion`	`string \| null`	no	—
`sizeBytes`	`integer (int64)`	no	—
`tags`	`string[] \| null`	no	—

ReplaceDocumentFieldEnvelopeDto

Property	Type	Required	Description
`algorithmVersion`	`integer (int32)`	no	—
`authTag`	`string \| null`	no	—
`ciphertext`	`string \| null`	no	—
`fieldId`	`string \| null`	no	—
`iv`	`string \| null`	no	—
`keyGeneration`	`integer (int32)`	no	—
`ordinal`	`integer (int32)`	no	—
`searchableValue`	`string \| null`	no	—

ResealSensitiveRecordRequestDto

Property	Type	Required	Description
`encryptedContent`	`string (byte) \| null`	no	—
`keyId`	`string \| null`	no	—
`sourceItemId`	`string \| null`	no	—

ResidualVisibilityCategoryDto

Property	Type	Required	Description
`appliesFrom`	`string (date)`	no	—
`categoryId`	`string (uuid) \| null`	no	—
`categoryName`	`string \| null`	no	—
`documentCount`	`integer (int32)`	no	—
`formerGuardianUserId`	`string (uuid) \| null`	no	—
`lawfulBasis`	`string \| null`	no	—
`retainsView`	`boolean`	no	—

ResidualVisibilityDto

Property	Type	Required	Description
`categories`	`ResidualVisibilityCategoryDto[] \| null`	no	—
`childUserId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

ResolvePendingFieldShareCommand

Property	Type	Required	Description
`fieldShareId`	`string (uuid)`	no	—
`requestingUserId`	`string (uuid)`	no	—
`wrappedFieldKeyBase64`	`string \| null`	no	—

ReturningNationalReconciliationDto

Property	Type	Required	Description
`bootstrapDecisionId`	`string (uuid) \| null`	no	—
`carryOverCount`	`integer (int32)`	no	—
`confirmedAt`	`string (date-time) \| null`	no	—
`deduplicatedCount`	`integer (int32)`	no	—
`disputeWindowClosesAt`	`string (date-time) \| null`	no	—
`disputeWindowHours`	`integer (int32) \| null`	no	—
`disputes`	`ReconciliationDisputeDto[] \| null`	no	—
`homeVaultId`	`string (uuid) \| null`	no	—
`intakeId`	`string (uuid)`	no	—
`items`	`ReconciliationItemDto[] \| null`	no	—
`leftBehindCount`	`integer (int32)`	no	—
`matchDecision`	`string \| null`	no	—
`originJurisdiction`	`string \| null`	no	—
`preparedAt`	`string (date-time)`	no	—
`reconciliationId`	`string (uuid)`	no	—
`returningUserId`	`string (uuid)`	no	—
`signature`	`ReconciliationSignatureDto`	no	—
`status`	`string \| null`	no	—

RevocationProofDto

Property	Type	Required	Description
`adultUserId`	`string (uuid)`	no	—
`childUserId`	`string (uuid)`	no	—
`guardianAccessRevokedAt`	`string (date-time)`	no	—
`ownershipReboundAt`	`string (date-time)`	no	—
`revokedGuardians`	`GuardianRevocationDto[] \| null`	no	—
`transitionId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—
`verificationCode`	`string \| null`	no	—

RevokeAttorneyScopeRequestDto

Property	Type	Required	Description
`scopeGrantId`	`string (uuid)`	no	—

RewrapOrganizationSealedDocumentRequestDto

Property	Type	Required	Description
`encryptedContent`	`string (byte) \| null`	no	—
`keyId`	`string \| null`	no	—

RollbackDocumentVersionCommand

Property	Type	Required	Description
`documentId`	`string (uuid)`	no	—
`expectedRowVersion`	`string \| null`	no	—
`userId`	`string (uuid)`	no	—
`versionNumber`	`integer (int32)`	no	—

RotatedHolderEnvelopeDto

Property	Type	Required	Description
`holderUserId`	`string (uuid)`	no	—
`wrappedMasterKey`	`string \| null`	no	—
`wrappedPrivateKey`	`string \| null`	no	—

RotateOrganizationKeyPairRequest

Property	Type	Required	Description
`holderEnvelopes`	`RotatedHolderEnvelopeDto[] \| null`	no	—
`newPublicKey`	`string \| null`	no	—

RotateSensitiveRoleKeyRequestDto

Property	Type	Required	Description
`publicKey`	`string \| null`	no	—

SearchFacet

Property	Type	Required	Description
`field`	`string \| null`	no	—
`label`	`string \| null`	no	—
`values`	`SearchFacetValue[] \| null`	no	—

SearchFacetDto

Property	Type	Required	Description
`displayName`	`string \| null`	no	—
`fieldName`	`string \| null`	no	—
`hasValues`	`boolean`	no	—
`valueCount`	`integer (int32)`	no	—
`values`	`FacetValueDto[] \| null`	no	—

SearchFacetValue

Property	Type	Required	Description
`count`	`integer (int32)`	no	—
`label`	`string \| null`	no	—
`value`	`string \| null`	no	—

SearchFilters

Property	Type	Required	Description
`categoryIds`	`(string (uuid))[] \| null`	no	—
`dateFrom`	`string (date-time) \| null`	no	—
`dateTo`	`string (date-time) \| null`	no	—
`fileTypes`	`string[] \| null`	no	—
`maxSize`	`integer (int64) \| null`	no	—
`minSize`	`integer (int64) \| null`	no	—
`schemaRefs`	`string[] \| null`	no	—
`tags`	`string[] \| null`	no	—

SearchOptions

Property	Type	Required	Description
`pageNumber`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`sortBy`	`string \| null`	no	—
`sortOrder`	`string \| null`	no	—

SearchResultDto

Property	Type	Required	Description
`degradedReason`	`string \| null`	no	—
`documents`	`DocumentDto[] \| null`	no	—
`facets`	`SearchFacetDto[] \| null`	no	—
`firstItemIndex`	`integer (int32)`	no	—
`hasNextPage`	`boolean`	no	—
`hasPreviousPage`	`boolean`	no	—
`isDegraded`	`boolean`	no	—
`isEmpty`	`boolean`	no	—
`lastItemIndex`	`integer (int32)`	no	—
`pageNumber`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`totalCount`	`integer (int64)`	no	—
`totalPages`	`integer (int32)`	no	—

SearchSuggestion

Property	Type	Required	Description
`context`	`string \| null`	no	—
`label`	`string \| null`	no	—
`type`	`string \| null`	no	—
`value`	`string \| null`	no	—

SeedSupervisedVaultRequestDto

Property	Type	Required	Description
`custodyOrderReference`	`string \| null`	no	—
`graduationDate`	`string (date)`	no	—
`guardians`	`GuardianRoleAssignmentDto[] \| null`	no	—
`jurisdiction`	`string \| null`	no	—
`minorUserId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

SelfExclusionDto

Property	Type	Required	Description
`blockedActivities`	`string[] \| null`	no	—
`id`	`string (uuid)`	no	—
`jurisdiction`	`string \| null`	no	—
`permanent`	`boolean`	no	—
`scheme`	`string \| null`	no	—
`startedAt`	`string (date-time)`	no	—
`status`	`string \| null`	no	—
`validUntil`	`string (date-time)`	no	—

SensitiveRecordResealedDto

Property	Type	Required	Description
`documentId`	`string (uuid)`	no	—
`keyId`	`string \| null`	no	—
`recordsSealedToRetiringKey`	`integer (int32)`	no	—
`resealed`	`boolean`	no	—
`vaultId`	`string (uuid)`	no	—

SensitiveRoleKeyDto

Property	Type	Required	Description
`programmeMemberId`	`string (uuid)`	no	—
`sensitiveRoleKeyId`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

SensitiveRoleKeyRetirementDto

Property	Type	Required	Description
`recordsSealedToReplacement`	`integer (int32)`	no	—
`replacedByKeyId`	`string \| null`	no	—
`retiredAt`	`string (date-time)`	no	—
`retiredKeyId`	`string \| null`	no	—
`rotatedAt`	`string (date-time)`	no	—

SensitiveRoleKeyRotationDto

Property	Type	Required	Description
`programmeMemberId`	`string (uuid)`	no	—
`recordsSealedToRetiringKey`	`integer (int32)`	no	—
`remainingSourceItemIds`	`string[] \| null`	no	—
`retirements`	`SensitiveRoleKeyRetirementDto[] \| null`	no	—
`retiringKeyId`	`string \| null`	no	—
`rotatedAt`	`string (date-time) \| null`	no	—
`sensitiveRoleKeyId`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

SensitivityLabelDowngradeDecisionDto

Property	Type	Required	Description
`decidedAt`	`string (date-time)`	no	—
`decidedBy`	`string (uuid)`	no	—
`decision`	`string \| null`	no	—
`documentId`	`string (uuid)`	no	—
`fromLabel`	`string \| null`	no	—
`requestedAt`	`string (date-time)`	no	—
`requestedBy`	`string (uuid)`	no	—
`requestedLabel`	`string \| null`	no	—
`sensitivityLabel`	`string \| null`	no	—

SensitivityLabelDowngradeQueueDto

Property	Type	Required	Description
`items`	`SensitivityLabelDowngradeRequestDto[] \| null`	no	—
`limit`	`integer (int32)`	no	—
`truncated`	`boolean`	no	—

SensitivityLabelDowngradeRequestDto

Property	Type	Required	Description
`currentLabel`	`string \| null`	no	—
`documentId`	`string (uuid)`	no	—
`requestedAt`	`string (date-time)`	no	—
`requestedBy`	`string (uuid)`	no	—
`requestedLabel`	`string \| null`	no	—
`sourceItemId`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

SetGuardianRolesRequestDto

Property	Type	Required	Description
`custodyOrderReference`	`string \| null`	no	—
`guardians`	`GuardianRoleAssignmentDto[] \| null`	no	—

ShareCrossing

0 | 1 | 2 with no declared properties.

SharedBlobCreatedDto

Property	Type	Required	Description
`blobId`	`string (uuid)`	no	—
`uri`	`string \| null`	no	—

SharedWithMeFieldShareDto

Property	Type	Required	Description
`accessLevel`	`string \| null`	no	—
`documentId`	`string (uuid)`	no	—
`documentName`	`string \| null`	no	—
`expiresAt`	`string (date-time) \| null`	no	—
`fieldId`	`string \| null`	no	—
`fieldLabel`	`string \| null`	no	—
`grantedAt`	`string (date-time)`	no	—
`id`	`string (uuid)`	no	—
`pendingResolutionDeadline`	`string (date-time) \| null`	no	—
`recipientOrgId`	`string (uuid) \| null`	no	—
`recipientType`	`string \| null`	no	—
`recipientUserId`	`string (uuid) \| null`	no	—
`revokedAt`	`string (date-time) \| null`	no	—
`sharedByUserId`	`string (uuid)`	no	—
`sharerDisplayName`	`string \| null`	no	—
`sharerNote`	`string \| null`	no	—
`sharerType`	`string \| null`	no	—
`status`	`string \| null`	no	—
`wrappedKey`	`string \| null`	no	—

SharedWithMeFieldShareDtoPagedResultDto

Property	Type	Required	Description
`hasNextPage`	`boolean`	no	—
`hasPreviousPage`	`boolean`	no	—
`items`	`SharedWithMeFieldShareDto[] \| null`	no	—
`pageNumber`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`totalCount`	`integer (int32)`	no	—
`totalPages`	`integer (int32)`	no	—

ShareFieldCommand

Property	Type	Required	Description
`accessLevel`	`string \| null`	no	—
`consentId`	`string (uuid) \| null`	no	—
`createdByUserId`	`string (uuid)`	no	—
`documentId`	`string (uuid)`	no	—
`expiresAt`	`string (date-time) \| null`	no	—
`fieldId`	`string \| null`	no	—
`fieldLabel`	`string \| null`	no	—
`mintConsentOnWiden`	`boolean`	no	—
`recipientDisplayName`	`string \| null`	no	—
`recipientKeyUnavailable`	`boolean`	no	—
`recipientOrgId`	`string (uuid) \| null`	no	—
`recipientType`	`string \| null`	no	—
`recipientUserId`	`string (uuid) \| null`	no	—
`sharedBlobReference`	`string \| null`	no	—
`sharerDisplayName`	`string \| null`	no	—
`sharerNote`	`string \| null`	no	—
`sharerType`	`string \| null`	no	—
`sharingKeyAuthTagBase64`	`string \| null`	no	—
`sharingKeyNonceBase64`	`string \| null`	no	—
`wrappedFieldKeyBase64`	`string \| null`	no	—
`wrappedSharingKeyBase64`	`string \| null`	no	—

SplitContainerRebindOutcomeDto

Property	Type	Required	Description
`accessRevoked`	`boolean`	no	—
`containerId`	`string (uuid)`	no	—
`outcome`	`string \| null`	no	—

SponsoredPlanStatusDto

Property	Type	Required	Description
`currentPlan`	`string \| null`	no	—
`hasPendingOffer`	`boolean`	no	—
`pendingOfferCount`	`integer (int32)`	no	—
`pendingOfferId`	`string (uuid) \| null`	no	—
`proposedPlan`	`string \| null`	no	—

SponsorRecordWithdrawalResultDto

Property	Type	Required	Description
`documentId`	`string (uuid) \| null`	no	—
`vaultId`	`string (uuid)`	no	—
`withdrawn`	`boolean`	no	—

SponsorSealingKeyDto

Property	Type	Required	Description
`keyId`	`string \| null`	no	—
`publicKey`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

StageMergeConflictsRequestDto

Property	Type	Required	Description
`resolutions`	`StageMergeResolutionDto[] \| null`	no	—

StageMergeResolutionDto

Property	Type	Required	Description
`decision`	`string \| null`	no	—
`sourceDocumentId`	`string (uuid)`	no	—

SubjectExportCategoryScopeDto

Property	Type	Required	Description
`category`	`string \| null`	no	—
`estimatedBytes`	`integer (int64)`	no	—
`recordCount`	`integer (int32)`	no	—

SubjectExportEntryDto

Property	Type	Required	Description
`category`	`string \| null`	no	—
`data`	`map<string, unspecified> \| null`	no	—
`reference`	`string \| null`	no	—

SubjectExportPageDto

Property	Type	Required	Description
`capturedAt`	`string (date-time)`	no	—
`category`	`string \| null`	no	—
`entries`	`SubjectExportEntryDto[] \| null`	no	—
`hasMore`	`boolean`	no	—
`skip`	`integer (int32)`	no	—
`subjectId`	`string (uuid)`	no	—
`take`	`integer (int32)`	no	—
`totalCount`	`integer (int32)`	no	—
`zeroKnowledgeNotice`	`string \| null`	no	—

SubjectExportScopeDto

Property	Type	Required	Description
`categories`	`SubjectExportCategoryScopeDto[] \| null`	no	—
`measuredAt`	`string (date-time)`	no	—
`storedContentBytes`	`integer (int64)`	no	—
`subjectId`	`string (uuid)`	no	—
`vaultCount`	`integer (int32)`	no	—

SubscriberFieldEnvelopeDto

Property	Type	Required	Description
`subscriberId`	`string (uuid)`	no	—
`wrappedFieldKeyBase64`	`string \| null`	no	—

SubscriptionSyncResult

Property	Type	Required	Description
`deliveredCount`	`integer (int32)`	no	—
`deliveredSubscriptionIds`	`(string (uuid))[] \| null`	no	—
`exhaustedCount`	`integer (int32)`	no	—
`heldCount`	`integer (int32)`	no	—
`suppressedCount`	`integer (int32)`	no	—

SuggestCategoryQueryResult

Property	Type	Required	Description
`suggestions`	`CategorySuggestion[] \| null`	no	—

SupersessionDependentDto

Property	Type	Required	Description
`consentIds`	`(string (uuid))[] \| null`	no	—
`fieldIds`	`string[] \| null`	no	—
`recipientDisplayName`	`string \| null`	no	—
`recipientOrgId`	`string (uuid) \| null`	no	—
`recipientType`	`string \| null`	no	—
`recipientUserId`	`string (uuid) \| null`	no	—

SupervisedVaultDto

Property	Type	Required	Description
`custodyOrderReference`	`string \| null`	no	—
`graduationDate`	`string (date)`	no	—
`guardians`	`GuardianRoleAssignmentDto[] \| null`	no	—
`jurisdiction`	`string \| null`	no	—
`minorUserId`	`string (uuid)`	no	—
`provisionedByUserId`	`string (uuid)`	no	—
`provisioningId`	`string (uuid)`	no	—
`reboundAt`	`string (date-time) \| null`	no	—
`reboundToAdultUserId`	`string (uuid) \| null`	no	—
`reboundTransitionId`	`string (uuid) \| null`	no	—
`status`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

SupplierPortalDocumentUploadRequestDto

Property	Type	Required	Description
`algorithmVersion`	`integer (int32)`	no	—
`authenticationTag`	`string \| null`	no	—
`encryptedContent`	`string (byte) \| null`	no	—
`fileName`	`string \| null`	no	—
`initializationVector`	`string \| null`	no	—
`keyGeneration`	`integer (int32)`	no	—
`keyId`	`string \| null`	no	—
`mimeType`	`string \| null`	no	—

SupplierPortalUploadTargetDto

Property	Type	Required	Description
`algorithm`	`string \| null`	no	—
`organizationId`	`string (uuid)`	no	—
`publicKey`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

SuspendFieldShareRequestDto

Property	Type	Required	Description
`graceWindowDays`	`integer (int32) \| null`	no	—

SyncSubscribedFieldRequestDto

Property	Type	Required	Description
`documentId`	`string (uuid)`	no	—
`fieldId`	`string \| null`	no	—
`newValueHash`	`string \| null`	no	—
`subscriberEnvelopes`	`SubscriberFieldEnvelopeDto[] \| null`	no	—

TeardownCohortDto

Property	Type	Required	Description
`confirmed`	`integer (int32)`	no	—
`pending`	`integer (int32)`	no	—
`total`	`integer (int32)`	no	—

TemplateDto

Property	Type	Required	Description
`category`	`string \| null`	no	—
`createdAt`	`string (date-time)`	no	—
`description`	`string \| null`	no	—
`fieldMappings`	`TemplateFieldMappingDto[] \| null`	no	—
`icon`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`isActive`	`boolean`	no	—
`localizedDescriptions`	`map<string, string> \| null`	no	—
`localizedNames`	`map<string, string> \| null`	no	—
`name`	`string \| null`	no	—
`previewImage`	`string \| null`	no	—
`schemaRef`	`string \| null`	no	—
`updatedAt`	`string (date-time)`	no	—

TemplateFieldMappingDto

Property	Type	Required	Description
`fieldName`	`string \| null`	no	—
`isRequired`	`boolean`	no	—
`localizedHelpTexts`	`map<string, string> \| null`	no	—
`localizedLabels`	`map<string, string> \| null`	no	—
`localizedPlaceholders`	`map<string, string> \| null`	no	—
`validationRules`	`string \| null`	no	—

TransferCustodyRequestDto

Property	Type	Required	Description
`newCustodians`	`GuardianRoleAssignmentDto[] \| null`	no	—
`orderReference`	`string \| null`	no	—

TransitionPrepDto

Property	Type	Required	Description
`childUserId`	`string (uuid)`	no	—
`contentGroups`	`VaultContentGroupDto[] \| null`	no	—
`handoverCompleted`	`boolean`	no	—
`totalDocuments`	`integer (int32)`	no	—
`vaultId`	`string (uuid)`	no	—

TrashedContactDto

Property	Type	Required	Description
`closureContext`	`string (uuid) \| null`	no	—
`contactLinkId`	`string (uuid)`	no	—
`handoverRecordId`	`string (uuid)`	no	—
`recoveryWindowExpiresAt`	`string (date-time)`	no	—
`trashedAt`	`string (date-time)`	no	—
`vaultId`	`string (uuid)`	no	—

TrashedDocumentDto

Property	Type	Required	Description
`categoryId`	`string (uuid) \| null`	no	—
`createdAt`	`string (date-time)`	no	—
`daysRemaining`	`integer (int32)`	no	—
`deletedAt`	`string (date-time)`	no	—
`fileName`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`mimeType`	`string \| null`	no	—
`purgeEligibleAt`	`string (date-time)`	no	—
`recoveryWindowDays`	`integer (int32)`	no	—
`sizeBytes`	`integer (int64)`	no	—
`vaultId`	`string (uuid)`	no	—

UnlockOrganizationRecoveryKitRequest

Property	Type	Required	Description
`verifier`	`string \| null`	no	—

UpdateCategoryCommand

Property	Type	Required	Description
`categoryId`	`string (uuid)`	no	—
`colorCode`	`string \| null`	no	—
`description`	`string \| null`	no	—
`displayOrder`	`integer (int32) \| null`	no	—
`icon`	`string \| null`	no	—
`name`	`string \| null`	no	—
`requestingUserId`	`string (uuid)`	no	—

UpdateEncryptionMetadataRequestDto

Property	Type	Required	Description
`algorithm`	`string \| null`	no	—
`algorithmVersion`	`integer (int32)`	no	—
`authenticationTag`	`string \| null`	no	—
`expectedRowVersion`	`string \| null`	no	—
`initializationVector`	`string \| null`	no	—
`iterations`	`integer (int32)`	no	—
`keyDerivationFunction`	`string \| null`	no	—
`keyGeneration`	`integer (int32)`	no	—
`keyId`	`string \| null`	no	—
`salt`	`string \| null`	no	—

UpdateRoleRequest

Request model for updating a user's role.

Property	Type	Required	Description
`newRole`	`VaultRole`	no	—

UpdateSharePermissionCommand

Property	Type	Required	Description
`accessLevel`	`string \| null`	no	—
`documentId`	`string (uuid)`	no	—
`requestingUserId`	`string (uuid)`	no	—
`shareId`	`string (uuid)`	no	—

UpdateTemplateCommand

Property	Type	Required	Description
`description`	`string \| null`	no	—
`fieldMappings`	`TemplateFieldMappingDto[] \| null`	no	—
`icon`	`string \| null`	no	—
`localizedDescriptions`	`map<string, string> \| null`	no	—
`localizedNames`	`map<string, string> \| null`	no	—
`name`	`string \| null`	no	—
`previewImage`	`string \| null`	no	—
`templateId`	`string (uuid)`	no	—

UpdateTemplateCommandResult

Property	Type	Required	Description
`name`	`string \| null`	no	—
`templateId`	`string (uuid)`	no	—
`updatedAt`	`string (date-time)`	no	—

UpdateVaultCommand

Property	Type	Required	Description
`autoDeleteDays`	`integer (int32) \| null`	no	—
`autoDeleteEnabled`	`boolean`	no	—
`description`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`maxDocuments`	`integer (int32) \| null`	no	—
`maxStorageSizeBytes`	`integer (int64) \| null`	no	—
`name`	`string \| null`	no	—
`ownerId`	`string (uuid)`	no	—

UploadChunkCommand

Property	Type	Required	Description
`chunkData`	`string (byte) \| null`	no	—
`chunkHash`	`string \| null`	no	—
`chunkIndex`	`integer (int32)`	no	—
`requestingUserId`	`string (uuid)`	no	—
`uploadSessionId`	`string (uuid)`	no	—

UploadChunkCommandResult

Property	Type	Required	Description
`progress`	`number (double)`	no	—
`remainingChunks`	`integer (int32)`	no	—
`success`	`boolean`	no	—
`uploadedChunks`	`integer (int32)`	no	—

UploadSessionDto

Property	Type	Required	Description
`blobStoragePath`	`string \| null`	no	—
`chunkSize`	`integer (int32)`	no	—
`contentType`	`string \| null`	no	—
`createdAt`	`string (date-time)`	no	—
`expiresAt`	`string (date-time)`	no	—
`fileHash`	`string \| null`	no	—
`fileName`	`string \| null`	no	—
`fileSize`	`integer (int64)`	no	—
`id`	`string (uuid)`	no	—
`isComplete`	`boolean`	no	—
`progress`	`number (double)`	no	—
`remainingSeconds`	`number (double)`	no	—
`status`	`UploadStatus`	no	—
`totalChunks`	`integer (int32)`	no	—
`updatedAt`	`string (date-time)`	no	—
`uploadedChunks`	`(integer (int32))[] \| null`	no	—
`userId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

UploadStatus

0 | 1 | 2 | 3 | 4 | 5 | 6 with no declared properties.

VaultAccessDto

Property	Type	Required	Description
`createdAt`	`string (date-time)`	no	—
`expiresAt`	`string (date-time) \| null`	no	—
`grantedByUserId`	`string (uuid)`	no	—
`id`	`string (uuid)`	no	—
`isActive`	`boolean`	no	—
`role`	`VaultRole`	no	—
`userId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

VaultAttentionDto

Property	Type	Required	Description
`items`	`VaultAttentionItemDto[] \| null`	no	—
`jurisdiction`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—
`vaultName`	`string \| null`	no	—

VaultAttentionItemDto

Property	Type	Required	Description
`dueAt`	`string (date-time) \| null`	no	—
`id`	`string (uuid)`	no	—
`kind`	`string \| null`	no	—
`title`	`string \| null`	no	—

VaultContentGroupDto

Property	Type	Required	Description
`categoryId`	`string (uuid) \| null`	no	—
`categoryName`	`string \| null`	no	—
`documentCount`	`integer (int32)`	no	—

VaultCrossingRow

Property	Type	Required	Description
`crossing`	`ShareCrossing`	no	—
`documentId`	`string (uuid)`	no	—
`documentName`	`string \| null`	no	—
`fieldCount`	`integer (int32)`	no	—
`grantedAt`	`string (date-time)`	no	—
`recipientDisplayName`	`string \| null`	no	—
`recipientHomeRegion`	`string \| null`	no	—
`vaultHomeRegion`	`string \| null`	no	—

VaultCrossings

Property	Type	Required	Description
`crossBorder`	`integer (int32)`	no	—
`domestic`	`integer (int32)`	no	—
`rows`	`VaultCrossingRow[] \| null`	no	—
`unknown`	`integer (int32)`	no	—

VaultDto

Property	Type	Required	Description
`autoDeleteDays`	`integer (int32) \| null`	no	—
`autoDeleteEnabled`	`boolean`	no	—
`createdAt`	`string (date-time)`	no	—
`description`	`string \| null`	no	—
`documentCount`	`integer (int32)`	no	—
`encryptionAlgorithm`	`string \| null`	no	—
`fieldCount`	`integer (int32)`	no	—
`homeRegion`	`string \| null`	no	—
`id`	`string (uuid)`	no	—
`isActive`	`boolean`	no	—
`keyId`	`string \| null`	no	—
`maxDocuments`	`integer (int32)`	no	—
`maxStorageSizeBytes`	`integer (int64)`	no	—
`modifiedAt`	`string (date-time) \| null`	no	—
`name`	`string \| null`	no	—
`ownerId`	`string (uuid)`	no	—
`schemaBoundNotSealedCount`	`integer (int32)`	no	—
`sharedFieldCount`	`integer (int32)`	no	—
`storageUsedBytes`	`integer (int64)`	no	—
`vaultType`	`string \| null`	no	—

VaultDtoPagedResultDto

Property	Type	Required	Description
`hasNextPage`	`boolean`	no	—
`hasPreviousPage`	`boolean`	no	—
`items`	`VaultDto[] \| null`	no	—
`pageNumber`	`integer (int32)`	no	—
`pageSize`	`integer (int32)`	no	—
`totalCount`	`integer (int32)`	no	—
`totalPages`	`integer (int32)`	no	—

VaultImportSealReceiptDto

Property	Type	Required	Description
`algorithmLabel`	`string \| null`	no	—
`encryptedRecordCount`	`integer (int32)`	no	—
`importBatchId`	`string (uuid)`	no	—
`importedByUserId`	`string (uuid)`	no	—
`sealReceiptHash`	`string \| null`	no	—
`sealedAt`	`string (date-time)`	no	—
`status`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

VaultMergePreviewDto

Property	Type	Required	Description
`conflictCount`	`integer (int32)`	no	—
`criticalConflictCount`	`integer (int32)`	no	—
`duplicateRetainedCount`	`integer (int32)`	no	—
`keptCount`	`integer (int32)`	no	—
`mergeId`	`string (uuid)`	no	—
`previewedAt`	`string (date-time)`	no	—
`sourceHoldingCount`	`integer (int32)`	no	—
`sourceVaultId`	`string (uuid)`	no	—
`status`	`string \| null`	no	—
`targetHoldingCount`	`integer (int32)`	no	—
`targetVaultId`	`string (uuid)`	no	—

VaultMergeReceiptDto

Property	Type	Required	Description
`appliedAt`	`string (date-time)`	no	—
`items`	`MergeItemOutcomeDto[] \| null`	no	—
`mergeId`	`string (uuid)`	no	—
`mergedCount`	`integer (int32)`	no	—
`skippedCount`	`integer (int32)`	no	—
`status`	`string \| null`	no	—
`unreadableCount`	`integer (int32)`	no	—

VaultRole

1 | 2 | 3 with no declared properties.

VaultSplitContainerRebindDto

Property	Type	Required	Description
`accessRevoked`	`boolean`	no	—
`reboundAt`	`string (date-time)`	no	—
`receivingPartyId`	`string (uuid)`	no	—
`relinquishingPartyId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

VaultSplitRebindDto

Property	Type	Required	Description
`allocatedToCounterpart`	`integer (int32)`	no	—
`allocatedToYou`	`integer (int32)`	no	—
`committedAt`	`string (date-time)`	no	—
`completedAt`	`string (date-time) \| null`	no	—
`containers`	`VaultSplitContainerRebindDto[] \| null`	no	—
`id`	`string (uuid)`	no	—
`itemCount`	`integer (int32)`	no	—
`manifestHash`	`string \| null`	no	—
`outstandingToCounterpart`	`integer (int32)`	no	—
`outstandingToYou`	`integer (int32)`	no	—
`reboundToCounterpart`	`integer (int32)`	no	—
`reboundToYou`	`integer (int32)`	no	—
`retainedShared`	`integer (int32)`	no	—
`splitId`	`string \| null`	no	—
`status`	`string \| null`	no	—

VaultStorageReconciliationDto

Property	Type	Required	Description
`actualStorageUsedBytes`	`integer (int64)`	no	—
`corrected`	`boolean`	no	—
`driftBytes`	`integer (int64)`	no	—
`previousStorageUsedBytes`	`integer (int64)`	no	—
`storageQuotaBytes`	`integer (int64)`	no	—
`vaultId`	`string (uuid)`	no	—

VersionDifference

Property	Type	Required	Description
`changeType`	`string \| null`	no	—
`fieldName`	`string \| null`	no	—
`valueInVersion1`	`string \| null`	no	—
`valueInVersion2`	`string \| null`	no	—

VetContinuedAccessDto

Property	Type	Required	Description
`basis`	`string \| null`	no	—
`disclosedToNewKeeper`	`boolean`	no	—
`practiceName`	`string \| null`	no	—
`scope`	`string \| null`	no	—

WalletCredentialDto

Property	Type	Required	Description
`credentialId`	`string (uuid)`	no	—
`issuer`	`string \| null`	no	—
`kind`	`string \| null`	no	—
`name`	`string \| null`	no	—
`presentable`	`boolean`	no	—
`sensitive`	`boolean`	no	—
`status`	`string \| null`	no	—
`vaultRef`	`string \| null`	no	—

WalletReissueFanOutCommand

Property	Type	Required	Description
`consentToMarkCompromised`	`boolean`	no	—
`credentialIds`	`(string (uuid))[] \| null`	no	—
`idempotencyKey`	`string \| null`	no	—
`includeSensitive`	`boolean`	no	—
`ownerUserId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—

WalletReissueFanOutResultDto

Property	Type	Required	Description
`heldCount`	`integer (int32)`	no	—
`idempotencyKey`	`string \| null`	no	—
`markedCompromisedCount`	`integer (int32)`	no	—
`outcomes`	`CredentialFanoutOutcome[] \| null`	no	—
`reissueRequestedCount`	`integer (int32)`	no	—
`totalCredentials`	`integer (int32)`	no	—

WardOwnershipAcceptedDto

Property	Type	Required	Description
`adultUserId`	`string (uuid)`	no	—
`childUserId`	`string (uuid)`	no	—
`keyCustodyReference`	`string \| null`	no	—
`ownershipAcceptedAt`	`string (date-time)`	no	—
`residualGuardianViewsRevoked`	`integer (int32)`	no	—
`soleKeyCustodyConfirmed`	`boolean`	no	—
`transitionId`	`string (uuid)`	no	—
`vaultId`	`string (uuid)`	no	—
`verificationCode`	`string \| null`	no	—

WardSummaryDto

Property	Type	Required	Description
`childId`	`string (uuid)`	no	—
`currentAge`	`integer (int32) \| null`	no	—
`custodyOrderReference`	`string \| null`	no	—
`displayName`	`string \| null`	no	—
`guardians`	`GuardianRoleAssignmentDto[] \| null`	no	—
`jurisdiction`	`string \| null`	no	—
`majorityAge`	`integer (int32) \| null`	no	—
`majorityDate`	`string (date)`	no	—
`pendingApprovals`	`integer (int32)`	no	—
`status`	`string \| null`	no	—
`vaultId`	`string (uuid)`	no	—

WithdrawSponsorRecordRequestDto

Property	Type	Required	Description
`reasonCode`	`string \| null`	no	—
`sourceItemId`	`string \| null`	no	—

Essence Vault API ​

Access Reconstruction

Parameters

Request body

Responses

AccountMerge

Parameters

Request body

Responses

Parameters

Request body

Responses

Parameters

Request body

Responses

AdministrativeVaultAccess

Parameters

Request body

Responses

AttorneyScope

Parameters

Request body

Responses

Parameters

Request body

Responses

Parameters

Request body

Responses

Parameters

Request body

Responses

Parameters

Request body

Responses

Parameters

Request body

Responses

Categories

Parameters

Request body

Responses

Parameters

Request body

Responses

Parameters

Request body

Responses

Parameters

Request body

Responses

Parameters

Request body

Responses

Parameters

Request body

Responses

Parameters

Request body

Responses

Parameters

Request body

Responses

Parameters

Request body

Responses

Child Shared Records Space

Parameters

Request body

Responses

Contact Handover

Parameters

Request body

Responses

Parameters

Request body

Responses

Parameters

Request body

Responses

Essence Vault API