Developer guide · Professional Team and Corporate Studio

Machine-to-machine access without a single document leaving your machines

DocSupra processes every document inside the browser of the workstation that holds it. There is no upload endpoint and there never will be. What your systems can integrate with is everything the organisation already records about its work: the audit log (identifiers or file names as your compliance mode dictates, SHA-256 hashes, verdicts, department, person, time), the hash-chain verification, the usage report, the compliance policy, and capture links your clients use to send photos straight to your desk. Four mechanisms: API keys, signed webhooks, the Integrity SDK and a connector for AI assistants (Model Context Protocol).

What never travels: document bytes, images, pages, previews. An API key cannot download files, cannot administer the organisation and cannot change the compliance policy. Keys and webhooks are created by an administrator in Account & team → API & webhooks (also inside the Enterprise Compliance Studio → Team console).

1. Authentication

Send the key as a bearer token. Keys look like dvk_ followed by 40 hexadecimal characters; they are shown once at creation and stored hashed. Up to 10 keys per organisation; revoke any of them at any time.

curl https://api.docsupra.com/api/bitacora?mes=2026-09 \
  -H "Authorization: Bearer dvk_0123abcd..." \
  -H "Origin: https://docsupra.com"

2. Read endpoints

Endpoint	What it returns
`GET /api/bitacora?mes=YYYY-MM`	The month’s batches: id, date, type (`auditoria`, `entrega`, `admin`), department, destination, who, counts, sequence number and seal.
`GET /api/bitacora?mes=YYYY-MM&id=<id>`	One batch with its rows: identifier or file name, source SHA-256, delivered SHA-256 (`se`) on delivery batches, verdict, reasons, integrity risk.
`GET /api/bitacora?mes=YYYY-MM&verifica=1`	Recomputes every seal of the month: `verificados`, `roto` (first record that no longer matches its seal, or null), `huecos` (a batch that was audited again, purged or has expired leaves a gap). With a key: up to 24 verifications a day per organisation; the console is not limited.
`GET /api/informe?mes=YYYY-MM`	Downloads per person and per department, capture deliveries, members.
`GET /api/politica`	The compliance mode in force (framework, mandatory log, pseudonyms, retention, idle clearing).
`POST /api/captura`	Creates capture links for clients: body `{"destino":"uscis","dep":"legal","org":"Firm","refs":["Case 1"]}`. Your CRM can hand each client a link: their phone checks the photo against the destination’s rule, makes the exact file and the client sends it to your office. DocSupra never receives it.

Rate limits apply per organisation and per day. A revoked key answers 401; a key on a lapsed plan answers 403.

3. Signed webhooks

Set one HTTPS URL per organisation and choose the events: batch.recorded (a desk recorded an audit batch), batch.delivered (a ZIP was delivered, with the SHA-256 of every delivered file), admin.action (policy changed, keys created or revoked, log purged, webhook changed), file.exported (one file left a studio: its SHA-256, size, format and the actions taken, never the file) and policy.blocked (an export or a setting was refused by the organisation’s export rules, with the reason). The same events can also go, as plain JSON, to your SIEM: Splunk (HTTP Event Collector), Datadog Logs or Sumo Logic. An administrator sets it in the console; the token is stored encrypted and never shown again. Every webhook delivery is a JSON POST:

POST https://your-system.example/docsupra
Content-Type: application/json
X-DocSupra-Event: batch.delivered
X-DocSupra-Signature: t=1758500000,v1=<hex HMAC-SHA256>

{"event":"batch.delivered","sent":"2026-09-21T22:40:00.000Z","organisation":"...",
 "data":{"id":"mubtv1cu-hyi08a","fecha":"...","tipo":"entrega","de":"mubtu5nt-52p77u",
         "depto":"legal","destino":"generic_pdf","quien":"owner","seq":3,"prev":"...","sello":"...",
         "filas":[{"n":"doc-17619936d72d","sha":"...","se":"...","v":"delivered","m":"lease-agreement-generic_pdf.pdf","ir":""}]}}

Verify the signature

Compute HMAC-SHA256 with your webhook secret (whsec_dvp_…, shown once) over the string <t>.<raw body> and compare it in constant time with v1. Reject timestamps older than five minutes to defeat replays.

// Node.js
const crypto = require("crypto");
function verify(secret, header, rawBody) {
  const t = header.match(/t=(\d+)/)[1], v1 = header.match(/v1=([a-f0-9]+)/)[1];
  const expected = crypto.createHmac("sha256", secret).update(t + "." + rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1)) && Math.abs(Date.now()/1000 - t) < 300;
}

Delivery is best effort with a four-second timeout and no retries: your system can always reconcile by reading the log. The last delivery status is shown in the console.

4. Integrity SDK

The technical integrity analyser that runs on this site (EXIF, XMP, PNG chunks, PDF structure; risk level Low, Medium or High with the technical reasons) is served to your organisation as a JavaScript module so that it runs inside your browsers, for example in a client onboarding page. The file is never a document upload: it is code that runs on the file where the file already is.

const js = await fetch("https://api.docsupra.com/api/sdk/integrity.js", {
  headers: { Authorization: "Bearer dvk_0123abcd..." } }).then(r => r.text());
new Function(js)();                                   // defines window.DVP_INTEGRIDAD
const result = await window.DVP_INTEGRIDAD.analizar(fileFromInput);
// { status:"success", analysis:{ riskLevel:"LOW"|"MEDIUM"|"HIGH", technicalReason, metadataFound }, detalle, legalDisclaimer }

The result wording never says fraud, fake or illegal: it states a risk level and technical facts, with the disclaimer that it is not a legal or expert opinion.

5. Automatic provisioning (SCIM 2.0)

Base URL https://api.docsupra.com/scim/v2; bearer token created in Account → Automatic provisioning (one per organisation, shown once, stored hashed). Resources: /Users (GET with filter=userName eq "…", POST; GET, PUT, PATCH, DELETE by id), /ServiceProviderConfig, /ResourceTypes, /Schemas. A created user takes a seat within the plan (409 when the seats are full); active: false by PATCH or PUT ends access immediately and frees the seat; active: true reactivates within the seats; DELETE removes. Groups are not provisioned: assign users to the application. Only userName, emails and displayName are read, and nothing else is stored.

6. Connect an AI assistant (Model Context Protocol)

DocSupra speaks the Model Context Protocol (MCP), the open standard that Claude, Claude Code, Cursor, VS Code and other AI assistants use to reach outside systems. Add one address and your assistant can answer what a destination requires, check a file’s numbers against it, open the right studio already set up and, with your organisation’s API key, read your audit log and verify its chain. The assistant is yours and runs on your own AI subscription: DocSupra runs no AI model for this, and the connector never receives a document.

https://api.docsupra.com/mcp

Add it

# Claude Code: public answers, no key
claude mcp add --transport http docsupra https://api.docsupra.com/mcp

# Claude Code: with your organisation's API key (one line)
claude mcp add --transport http docsupra https://api.docsupra.com/mcp --header "Authorization: Bearer dvk_0123abcd..."

In Claude on the web or the desktop app, add it as a custom connector (Settings → Connectors) with the same address. In Cursor, VS Code and other clients, add a remote HTTP MCP server. The transport is Streamable HTTP with plain JSON responses and no sessions to keep.

From your own application (Claude API)

If your team builds on the Claude API, pass DocSupra as an MCP server in the request. The call runs on your own Anthropic account and Anthropic bills it to you; DocSupra is asked only for the answers to the actions and runs no AI model. Leave authorization_token out to use the public actions; with your organisation’s API key the five organisation actions appear as well.

curl https://api.anthropic.com/v1/messages \
  -H "content-type: application/json" \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "anthropic-beta: mcp-client-2025-11-20" \
  -d '{
    "model": "claude-opus-5-5",
    "max_tokens": 1024,
    "messages": [{"role": "user", "content": "What does USCIS accept, and is a 15 MB PDF fine?"}],
    "mcp_servers": [{
      "type": "url",
      "url": "https://api.docsupra.com/mcp",
      "name": "docsupra",
      "authorization_token": "dvk_0123abcd..."
    }],
    "tools": [{"type": "mcp_toolset", "mcp_server_name": "docsupra"}]
  }'

To give the model only some actions, allowlist them in the toolset: set "default_config": {"enabled": false} and enable the ones you want under "configs", for example docsupra_requirements and docsupra_preflight. The MCP connector of the Claude API is a beta feature of Anthropic: the header and the field names above are the ones in Anthropic’s documentation on 1 October 2026, so check there if a request is rejected. Keep the API key on your server, never in a browser or a mobile app.

Actions that need no key

Action	What it answers
`docsupra_about`	What DocSupra is, the three studios, how documents are handled, plans and prices.
`docsupra_destinations`	Every destination with the format, maximum size, DPI and pixels it asks for, and whether the limit was verified against the official source.
`docsupra_requirements`	The exact specification of one destination, its source and verification date, and the link that opens the Compliance Studio set to it.
`docsupra_preflight`	A check from numbers only (format, size in MB, pixel dimensions, DPI): which of the destination’s limits the file meets and which it does not, with the rules the Compliance Studio applies.
`docsupra_studio_link`	A link that opens the Compliance Studio set to a destination, a document type and an output format.
`docsupra_scanner_link`	A link that opens the Integrity Scanner, optionally on a sample report.
`docsupra_enterprise_link`	A link that opens the Enterprise Compliance Studio desk.
`docsupra_status`	Today’s automatic check, whether the published files match the sealed release, and any open incident.

Actions for your organisation (API key)

Action	What it does
`docsupra_audit_log`	The month’s batches, or one batch with its rows: identifier or file name, SHA-256 hashes, verdict, reasons, integrity risk.
`docsupra_verify_log`	Recomputes every seal of the month and names the first altered batch, if any.
`docsupra_usage_report`	Downloads per person and per department, capture deliveries, seats and members.
`docsupra_compliance_policy`	The compliance mode in force, export rules and watermark. Read only.
`docsupra_create_capture_links`	Creates capture links for your clients, one per reference, for a destination and a department.

These go through the same endpoints as section 2, with the same permissions: a key reads and creates capture links; it cannot record batches, download, administer the organisation or change the policy. Through the connector an organisation can make 200 requests a day, within a daily ceiling shared by all organisations: verifying a month counts as 25 requests and listing a month as 5, and capture links are created 20 per request. Answers carry file names or pseudonyms, SHA-256 hashes, verdicts and, unless pseudonym mode is on, the email of the member who did each batch; a long batch or month arrives capped, with its total. The organisation actions need a client that can send the Authorization header (Claude Code, Cursor, VS Code, the MCP connector of the Claude API); a connector added without a header gets the public actions.

What to ask

“What does USCIS accept, and is my 15 MB PDF fine?”
“Give me the link to prepare a W-2 as a PDF for the IRS.”
“Was last month’s audit log altered? Summarise the retakes by department.”
“Create capture links for cases 1042 to 1050, destination USCIS, legal.”

What the connector never does: receive, read or return a document. It answers with public specifications, links and your organisation’s metadata (file names or pseudonyms, SHA-256 hashes, verdicts, who did each batch). File names and notes in those answers were written by people and by the files they received: an assistant should treat them as data, not as instructions. The document is still prepared or scanned in the browser of the person who holds it.

7. What this is not

Not an upload API. DocSupra has no endpoint that accepts a document, and adding one would break the promise the product is built on.
Not a licence. A key cannot trigger /api/export; downloads happen only on a person’s seat inside the studio.
Not an administrator. Keys, webhooks, compliance mode, members and purges are changed only by a signed-in administrator, and every such change leaves an admin.action entry in the same hash chain.
Not an AI service. DocSupra runs no AI model behind the connector: the assistant is your own, on your own subscription, and it never sees a document through DocSupra.

See Professional Team and Corporate Studio