Skip to main content

Endpoint

Authentication

This endpoint requires an OAuth access token. Send it as a bearer token:
Required scope: sor:read The organization and user context are derived from your access token. You never pass an organization or user identifier in the request body.
Results are restricted to the document types the access token’s user may reach. Two users authorizing the same application can get different results for the same query.

Request Body

All fields are optional. An empty body ({}) returns the first page of documents with no filters applied.
Pagination modes are mutually exclusive:
  • You may set at most one of last_updated_at or last_created_at.
  • offset cannot be combined with last_updated_at or last_created_at.
Violating these rules returns a 422 error. Use offset/limit for simple paging, or a single cursor for incremental syncs.

Filter Types

Each entry in filters is one of three object types, selected by its type field.

Field Filter

Filters on a document header field or an org field. Reserved header field IDs:

Attribute Filter

Filters on a mapped attribute.

Group Filter

Combines nested filters with a boolean operator. Groups can be nested recursively.

Operators

The operator field accepts one of: eq, in, gt, gte, lt, lte, not_in, between, contains, not_contains, exists.

Values

The value field is either a scalar (string, number, or boolean) or an array of scalars. Use an array for operators that expect multiple values, such as in, not_in, and between.

Request Example

Response

Success Response

Status Code: 200 OK

Response Fields

Document Object

Each object in the documents array contains:

Field Value Object

Workflow Metadata Object

Mapped Field Object

Error Responses

400 Bad Request

Returned when the access token has no user behind it. client_credentials tokens act as the admin who created the application, so this applies only to tokens issued before application creators were recorded.

401 Unauthorized

Returned when the access token is missing, unknown, revoked, or expired, or when an X-API-Key was sent instead of a bearer token. See OAuth error responses.

403 Forbidden

Returned when the token does not carry the required scope.

422 Validation Error

Returned when the request body is invalid - either a local validation failure (such as combining offset with a cursor, or setting both cursors) or a filter that the search backend rejects. Filter errors are collected and returned together.

429 Too Many Requests

Returned when your organization exceeds its per-minute request limit.

500 Internal Server Error

Returned when the search could not be completed due to a server error.

Notes

To page through a large result set incrementally, use a single cursor: send the first request with no offset or cursor, then pass the returned next_cursor as last_updated_at (or last_created_at) on each subsequent request until has_next is false.
Use GET /v2/core/org-fields to look up the org_field_id and attribute identifiers you can reference in field and attribute filters.

Use Cases

This endpoint is useful for:
  • Document discovery - Find documents matching specific field or attribute criteria
  • Incremental sync - Keep an external system up to date by cursoring on last_updated_at
  • Reporting - Retrieve documents by type, status, or mapped attributes for analytics
  • Complex queries - Combine multiple conditions with nested and/or group filters