# DocJacket Platform API

DocJacket provides a stateful real-estate transaction operations and intelligence API
for applications serving transaction coordinators, real-estate agents, teams,
brokerages, and technology partners.

Base URL: https://api.docjacket.com

## Canonical resources

- Interactive reference: https://api.docjacket.com/reference
- OpenAPI JSON: https://api.docjacket.com/openapi.json
- OpenAPI YAML: https://api.docjacket.com/openapi.yaml
- Markdown API reference: https://api.docjacket.com/api-reference.md
- Integration guide: https://api.docjacket.com/integration-guide.md
- Expanded overview for AI tools: https://api.docjacket.com/llms-full.txt
- Developer landing page: https://api.docjacket.com/developers
- Guides and tutorials: https://help.docjacket.com/docs/api

The OpenAPI specification is the canonical machine-readable source of truth. Everything
else on this list — including this file — is derived from it or describes it.

AI agents and developer tools should read the OpenAPI document rather than scraping the
JavaScript-rendered Scalar interface at /reference. That page is a
client-side application; fetching its HTML yields an empty shell, not the API surface.
If you want the operation list as text, use /api-reference.md.

## Authentication

All operations require a bearer token: `Authorization: Bearer <token>`. There are three
credential types, and they are not interchangeable.

- Organization key (prefix `mcp_at_`) — acts within exactly one organization. Scoped
  `read` (GETs), `draft` (low-risk writes), and `actions` (side-effecting writes such
  as sending email). Created in the DocJacket app under Settings -> Advanced -> API Keys.
- OAuth 2.1 access token — the same organization-scoped surface as an `mcp_at_` key and
  the same three scopes, but obtained by the user authorizing your app instead of by
  pasting a key. Use this when your app acts for many users: one registration, a token
  per user. See "OAuth integration" below.
- Reseller/partner key (prefix `rsk_`) — cross-tenant provisioning for white-label
  partners. Accepted only on `/api/v1/orgs/*`; rejected everywhere else. Organization
  keys and OAuth tokens are rejected on those partner routes in turn.

Choosing between the first two: a static key is simpler and right when you hold the
credential for a known account. OAuth is the one that scales — an app serving many
accounts would otherwise need a key minted by hand for each.

A request for a resource in another organization returns 404, never 403. Existence is
never disclosed across tenants. Do not attempt to infer or assert access across
organizations, and do not treat a 404 as evidence that an identifier is unused.

## Main resource categories

Transactions, messaging, key dates, tasks, documents, extractions, contacts,
disclosure packages, proposals, templates and forms, webhooks, organization settings,
and partner organization provisioning.

## Getting started

1. GET /api/v1/health — verifies the key and reports its scopes.
2. GET /api/v1/catalog — every operation, with a `callable` flag computed for your key.
3. GET /api/v1/usage — your key's call volume, top operations, and error rate.

Rate limits are per key, per minute, fixed window: 300 reads and 60 writes. Exceeding
a bucket returns 429 with `Retry-After: 60`.