Build with AdaptDoc

Authentication

curl -H "Authorization: Bearer adoc_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  https://doc.adaptensor.com/api/v1/documents

Key format: adoc_live_ + 32 random hex characters

Scoped permissions: Each key is limited to specific scopes (e.g., documents:read, documents:send). A request fails with 403 if the key lacks the required scope.

Storage: Keys are SHA-256 hashed. The plaintext is shown once at creation — store it securely.

Endpoint Reference

Rate Limiting

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 87
X-RateLimit-Reset: 1741564800

Webhooks

Available Events

javascript
const crypto = require("crypto");

const headerSig = request.headers["x-adaptdoc-signature"];   // "sha256=<hex>"
const timestamp = request.headers["x-adaptdoc-timestamp"];   // ISO string, may be undefined
const rawBody = request.rawBody;                              // request body as a string

// Subscription webhooks include the timestamp in the signed payload to make
// replay attacks visible. Dashboard webhooks sign the body alone.
const signedPayload = timestamp ? `${timestamp}.${rawBody}` : rawBody;

const expected = "sha256=" + crypto
  .createHmac("sha256", WEBHOOK_SECRET)
  .update(signedPayload)
  .digest("hex");

// Timing-safe compare prevents timing side-channel attacks.
const valid = headerSig.length === expected.length &&
  crypto.timingSafeEqual(Buffer.from(headerSig), Buffer.from(expected));

if (!valid) {
  throw new Error("Invalid webhook signature");
}

AdaptVault Integration

Error Handling

json
{
  "error": "Document not found",
  "status": 404
}