Developer platform

Build one booking-linked compliance workflow.

The DocinVault API treats guest compliance as a durable workflow object. Create a session once, receive asynchronous state changes, retrieve structured outcomes, and compile the approved evidence manifest without moving raw passports into operational systems by default.

Download OpenAPI 3.1 Discuss an integration

Integration lifecycle

A predictable contract from sandbox to production.

Authentication, idempotency, error handling, webhook delivery, and environment promotion are part of the API contract rather than customer-specific guesswork.

Authentication

Use a server-side bearer token in the Authorization header. Tokens must not be exposed in browsers or mobile application bundles.

Sandbox and production

Test workflow profiles, reason codes, review paths, and webhook consumers in the sandbox before production credentials are activated.

Idempotency

Send one Idempotency-Key for each logical create operation. Reuse it only when retrying the same request body.

Error model

Errors return a stable code, a readable message, a request identifier, and field-level details when validation fails.

Signed webhooks

Events are asynchronous, signed with X-DocinVault-Signature, and identified so consumers can reject replayed deliveries.

Retry behavior

Retry transient failures with bounded exponential backoff, honor Retry-After, and process every event idempotently.

API reference

A formal contract for sessions, outcomes, and evidence.

The repository OpenAPI 3.1 document is the public contract. Select an operation to inspect its purpose, request schema, and response states.

POST/v1/compliance-sessions

Create a booking-linked compliance session

Creates one compliance session from a configured workflow profile. Reusing the same Idempotency-Key with the same request body returns the original result.

Request schemaComplianceSessionCreateRequest

Responses

201: Compliance session created
400: Bad Request
401: Unauthorized
409: Conflict
422: Unprocessable Entity
429: Rate Limited

Implementation examples

Start with safe retries and verified event delivery.

These examples show the minimum integration behavior. Production consumers should keep secrets server-side, log request identifiers, and retain processed event identifiers for replay protection.

Create a compliance session

Use the booking reference and configured workflow key as stable operational context.

curl --request POST https://sandbox.api.docinvault.com/v1/compliance-sessions \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: booking-DV-1048-workflow-v3' \
  --header 'Content-Type: application/json' \
  --data '{"bookingReference":"DV-1048","propertyReference":"property-tbilisi-01","workflowKey":"remote-check-in-v3","guest":{"reference":"guest-a","email":"guest.a@example.com"}}'

Verify a webhook signature

Compute the HMAC over the exact raw body and compare equal-length buffers in constant time.

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyDocinVaultWebhook(rawBody, signature, secret) {
  const expected = `sha256=${createHmac('sha256', secret).update(rawBody).digest('hex')}`;
  const receivedBuffer = Buffer.from(signature);
  const expectedBuffer = Buffer.from(expected);
  return receivedBuffer.length === expectedBuffer.length &&
    timingSafeEqual(receivedBuffer, expectedBuffer);
}

Handle retries and replays

Acknowledge only after durable processing and store the event identifier before applying the state change.

if (await eventStore.has(event.id)) return response.status(200).end();

await database.transaction(async transaction => {
  await eventStore.record(event.id, transaction);
  await applyComplianceSessionUpdate(event.data, transaction);
});

return response.status(200).end();

Agentic control plane

Automation operates inside defined authority.

The control plane defines what may happen, the execution plane records what happened for this booking, and the evidence plane preserves the resulting audit record.

Control plane

What agents may do

Workflow profiles, schemas, thresholds, permissions, and human-review gates define agent authority.

Govern
Map
Measure
Manage

Execution plane

What happened for this booking

Configured agents request data, guide retries, run checks, route exceptions, and trigger approved next actions.

Actions
States
Reason codes
Review gates

Evidence plane

What can be reviewed later

Booking linkage, timestamps, decision history, integrity references, and export manifests form the audit record.

Audit events
Hashes
Retention
Export manifest

Autonomy boundary

Agents resolve routine gaps within fixed schemas and configured policies. They do not overwrite core identity data or approve policy exceptions without an authorized human decision.

Integration review

Map the API contract to your booking lifecycle.

Bring the booking events, required outputs, exception ownership, and production rollout path. We will map them to the session contract and activation checklist.

Discuss your integration