Developer API

The DocJacket API lets your own systems — CRMs, dashboards, back-office tools, scripts, and custom automations — read and act on your transactions, contacts, tasks, key dates, documents, and disclosures.

Everything lives under one base URL, and every request carries a bearer token:

• Base URL: https://api.docjacket.com
• Auth: Authorization: Bearer <your credential>

Live reference: api.docjacket.com/reference — generated from the deployed API, so it never drifts. The machine-readable spec is at api.docjacket.com/openapi.json (point Postman, an SDK generator, or an AI agent at it).

Which credential do I need?

Start here — what goes in that Authorization header depends on who is calling, and picking the wrong one is the single most common integration mistake:

Who is calling?	Use	Looks like	Where you get it
Your own code, against your own workspace — a script, a CRM sync, a back-office tool you run	Workspace API key	mcp_at_…	In the app: Settings → Advanced → API & AI Access → API keys (how)
An app other people sign in to — a mobile app, a portal, an integration you sell	OAuth sign-in — each user authorizes their own account; your app never holds a key	a short-lived token per user	Register your app once, then users sign in — quickstart
A white-label partner's systems — opening customer workspaces, managing seats	Partner key	rsk_…	Partner console → API keys (Partner API)
An AI assistant — Claude, ChatGPT, Gemini	AI Access — connect by pasting a URL, no code	handled for you	AI Access

Two rules that save the most support email:

• A partner key never reads deal data. rsk_… works only on the partner provisioning endpoints. To read or change what's inside a workspace, you need a workspace key or an OAuth token for that workspace — a partner key returns 401 on every data endpoint, no matter who minted it.
• If users sign in to your thing, don't mint keys for them. One workspace key per customer doesn't scale past a handful of accounts and makes you the custodian of their credentials. OAuth is the shape that scales — and it's the same endpoints with the same scopes.

If you're a white-label partner, this is the distinction in fifteen seconds — the partner console's keys, then the same customer's workspace keys:

One key, two doorways

Within a single workspace, the same mcp_at_ key powers both the REST API (this section) and AI Access — connecting AI assistants like Claude and ChatGPT over MCP. Use the API when your code calls DocJacket; use AI Access when an AI assistant does. Same permissions model, same audit trail.

Your first call

Create a key (see Authentication & API keys), then verify it and discover what it can do:

# Does my key work? Echoes your org + granted scopes.
curl https://api.docjacket.com/api/v1/health \
  -H "Authorization: Bearer mcp_at_YOUR_KEY"

# What can this key call? Every operation with a `callable` flag per your scopes.
curl https://api.docjacket.com/api/v1/catalog \
  -H "Authorization: Bearer mcp_at_YOUR_KEY"

/catalog is the quickest way to see the current surface — it lists every operation, its method and path, the scope it needs, and whether your key can call it. Once your key is working, GET /api/v1/usage reports your call volume, top operations, and error rate.

Prefer to read the whole surface at once? All operations lists every endpoint grouped by resource, with method, path, and required scope.

What you can do

• Read transactions, contacts, tasks, key dates, documents, checklists, contingencies, forms, disclosures, and email templates.
• Act — complete tasks, apply checklists, update key dates, create contacts, upload & extract documents, send client updates and document requests, manage disclosure packages.
• Get notified — subscribe to webhooks so DocJacket pushes events to you instead of you polling.
• See your usage — GET /api/v1/usage returns your key's call volume, daily breakdown, top operations, and error rate.
• Provision at scale — white-label partners use a reseller key to manage organizations across their book of business.

In this section

• Authentication & API keys — create, scope, rotate, and revoke keys.
• Build an app (quickstart) — end-to-end: explore with a key, register your app, sign users in with OAuth.
• Making requests — conventions, errors, rate limits, and recipes.
• All operations — every endpoint, grouped by resource, with method, path, and required scope.
• Webhooks — subscribe to events and verify signatures.
• Partner API — provisioning and read access for resellers.
• Versioning & changes — how the API evolves without breaking you.