> ## Documentation Index > Fetch the complete documentation index at: https://docs.privue.ai/llms.txt > Use this file to discover all available pages before exploring further. # Link to a contract's files > Link to the contract as it went to its signers, the stamp paper it went with, and once signed, what it left. The document as sent is held from the first read of the contract, which follows the send within moments. Once every signer has signed, the signed document and Signzy's audit certificate are held too. Each link comes with the SHA-256 of its file, the same as on the contract, to check what you download against. Each link works for a few minutes, so ask for them when you are about to read the files. Every file is held until the verification expires, and goes with it. ## OpenAPI ````yaml /verification/api-reference/openapi.json post /verifications/{verification_id}/contracts/{contract_id}/download openapi: 3.1.0 info: title: Verify with Privue description: >- Start identity-and-business verifications and read the results. There are three ways to run one, and a verification reads the same whichever it was. Every workflow declares which it is for as its `mode`, and a workflow is one of them and never more. **Hosted.** You create a verification with the user's mobile number, email, or both, and receive a journey URL, which we send to every contact you gave on a workflow that sends invitations. They work through the steps your workflow configures, on our screens, and submit. Use this when the person being verified is reachable and holds their own documents. **Staged.** You create a verification, upload each document you hold against the step it answers, and ask for the checks to run. They take longer than a request should be held open, so you read the result from a callback or by polling. Use this when documents reach you over time, or when you want them kept on the record to download later. **Instant.** You send the whole submission in one request. The checks run before it answers, so the reply is the finished record. The documents are read as they arrive and stored nowhere. Use this when you hold everything already and want the answer in the call you made. Whichever it was, you read the whole record: every step, its state, what it collected, and why anything did not pass. An instant verification hands you that record in its reply; for the other two, poll the verification or register a callback endpoint and be told when it is submitted. Across your whole account you can list the workflows configured for you, count your verifications by status, and page through the records behind a count. Every error response has the shape `{"code": "...", "detail": "..."}`. Branch on `code`: several causes share a status, and `detail` is written for a person reading a log rather than for code. Treat a code you do not recognise as the status it arrived at. version: 0.1.0 servers: - url: https://api.verify.privue.ai description: Production security: [] tags: - name: Workflows description: >- The workflows configured for your account. Read one to see its mode, the documents it asks for, and how each step is answered over the API: the slots its documents go in and the values it takes. - name: Verifications description: >- Starting a verification, ending one, clearing one to run the same subject again, and purging one. Shared by both modes. A start answers 201 when it created the verification and 200 when the subject already had one, so a duplicate is visible from the status code alone. - name: Hosted workflows description: >- For a workflow the person being verified walks themselves. Start a verification with their mobile number, email, or both; on a workflow that sends invitations we send them the journey URL. You can also hand it to them yourself, or open it for them from inside your own app with a handoff. - name: Staged workflows description: >- For a workflow you build up from documents you already hold. Upload each file against the step and slot it answers, withdraw one you got wrong, then ask for the checks to run and read the result when they have. Nobody is sent anywhere. - name: Instant workflows description: >- For a workflow answered in the request that asks it. Send the whole submission at once and read the finished record in the reply. Nothing is kept of the documents and nothing is left open to come back to. - name: Contracts description: >- Contracts a hosted verification is signed on once you approve it, on a version that offers them. Preview one, send it with the values you set, follow each signer, remind or withdraw it, and download what was signed. The verification completes once a contract of each it is offered is signed. - name: Results description: >- Reading what a verification came to: one record, a page of them, counts across your account, and links to the files it holds. paths: /verifications/{verification_id}/contracts/{contract_id}/download: post: tags: - Contracts summary: Link to a contract's files description: >- Link to the contract as it went to its signers, the stamp paper it went with, and once signed, what it left. The document as sent is held from the first read of the contract, which follows the send within moments. Once every signer has signed, the signed document and Signzy's audit certificate are held too. Each link comes with the SHA-256 of its file, the same as on the contract, to check what you download against. Each link works for a few minutes, so ask for them when you are about to read the files. Every file is held until the verification expires, and goes with it. operationId: >- download_verifications__verification_id__contracts__contract_id__download_post parameters: - name: verification_id in: path required: true schema: type: string format: uuid title: Verification Id - name: contract_id in: path required: true schema: type: string format: uuid title: Contract Id responses: '200': description: >- Short-lived links to every file of the contract held, each with its hash. content: application/json: schema: $ref: '#/components/schemas/ContractFiles' example: sent_document: url: https://files.verify.privue.ai/sent-document expires_in_seconds: 300 sha256: >- 0ca1d2c5c03e9bed744a4c3d18b6e2f71a9c05d4e83b27f6a1d9c4e05b72f3a8 stamp_paper: null signed_document: url: https://files.verify.privue.ai/signed-document expires_in_seconds: 300 sha256: >- 9f2c4e81b7d03a65c1e8f4a27b90d5c3e6a1f8b2d4c7e09a3b5f61d8c2e4a7b0 audit_certificate: url: https://files.verify.privue.ai/audit-certificate expires_in_seconds: 300 sha256: >- 4b7e1a93c2d8f05e6a3c9b17d4e2f80a5c6b3d91e7f2a4c08b5d3e6f1a9c2b74 '401': description: |- The API key is missing, malformed, or revoked. The code is `unauthenticated`. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: unauthenticated detail: Missing or malformed Authorization header '403': description: >- The workflow belongs to the other environment. An API key is for `uat` or for `production` and reaches only that environment's workflows. Or the key is valid but not enrolled for verifications, or not set up for exactly one of `uat` and `production`, in which case ask us to reissue it. The code is one of `environment-mismatch` or `client-not-enrolled`. content: application/json: example: code: environment-mismatch detail: >- workflow 'merchant-onboarding' is production and this request is for uat schema: $ref: '#/components/schemas/ErrorResponse' '404': description: >- No verification with that id exists on your account, or no contract with that id was sent on it. The code is one of `verification-not-found` or `contract-not-found`. content: application/json: example: code: verification-not-found detail: >- no contract 5e0c9a41-7b2d-4f68-a3c1-9d8e2f60b7a4 was sent on this verification schema: $ref: '#/components/schemas/ErrorResponse' '409': description: >- Nothing of the contract is held yet, since it has not been read since it was sent, or the verification has expired and its files went with it. The code is one of `contract-files-not-kept` or `verification-expired`. content: application/json: example: code: contract-files-not-kept detail: >- nothing of the contract is kept yet; it is read from Signzy within a few minutes of the send schema: $ref: '#/components/schemas/ErrorResponse' '422': description: |- An identifier in the path is not in the shape it takes. The code is `request-invalid`. content: application/json: example: code: request-invalid detail: >- verification_id: Input should be a valid UUID, invalid character: found `n` at 1 schema: $ref: '#/components/schemas/ErrorResponse' '429': description: |- The API key is rate limited. Retry after a pause. The code is `rate-limited`. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: rate-limited detail: 'Unauthorized: RATE_LIMITED' '503': description: |- API keys could not be checked right now. Retry. The code is `auth-unavailable`. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: auth-unavailable detail: Auth provider unavailable security: - HTTPBearer: [] components: schemas: ContractFiles: properties: sent_document: $ref: '#/components/schemas/ContractFileLink' description: The contract as it went to its signers. stamp_paper: anyOf: - $ref: '#/components/schemas/ContractFileLink' - type: 'null' description: >- The stamp paper it went with, as you sent it. Null on a contract sent without one. signed_document: anyOf: - $ref: '#/components/schemas/ContractFileLink' - type: 'null' description: The contract as every signer signed it. Null until it is signed. audit_certificate: anyOf: - $ref: '#/components/schemas/ContractFileLink' - type: 'null' description: >- Signzy's certificate of who signed it, when and how. Null until it is signed. type: object required: - sent_document - stamp_paper - signed_document - audit_certificate title: ContractFiles description: Links to every file of a contract held for you. ErrorResponse: properties: code: $ref: '#/components/schemas/ErrorCode' description: >- What went wrong. Branch on this rather than on the status code, which several causes share, and never on `detail`. Treat a code you do not recognise as the status it arrived at: codes are added as new causes become reachable, and an existing one never changes meaning. detail: type: string title: Detail description: >- What went wrong, in words, naming the workflow, verification, step or field at fault where one is. Written for a person reading a log rather than for code to read, so it is not stable and nothing should be matched against it. type: object required: - code - detail title: ErrorResponse description: The envelope every failure is answered in. ContractFileLink: properties: url: type: string title: Url description: Where to read the file. It stops working after `expires_in_seconds`. expires_in_seconds: type: integer title: Expires In Seconds description: How long the link works for. sha256: type: string title: Sha256 description: The SHA-256 of the file, in hex, to check what you download against. type: object required: - url - expires_in_seconds - sha256 title: ContractFileLink description: A short-lived link to one of a contract's files. ErrorCode: type: string enum: - unauthenticated - client-not-enrolled - rate-limited - auth-unavailable - environment-mismatch - request-invalid - body-unreadable - page-cursor-invalid - window-invalid - request-too-large - not-found - method-not-allowed - internal-error - workflow-not-found - workflow-version-not-found - workflow-not-runnable - workflow-not-walkable - workflow-misconfigured - context-incomplete - context-value-invalid - mobile-required - email-required - journey-fields-refused - return-url-not-allowed - reference-taken - verification-not-found - verification-not-open - verification-expired - invitations-off - invitation-throttled - not-invited - nothing-to-remind - reminder-throttled - verification-not-reviewable - verification-not-reopenable - contracts-out - verification-not-signable - run-in-progress - credits-exhausted - resets-exhausted - contract-credits-exhausted - live-limit-reached - step-not-found - step-not-reopenable - step-not-ready - step-invalid - document-not-found - document-not-stored - document-too-large - document-type-not-allowed - document-locked - contract-workflow-not-found - contract-not-found - contract-not-sendable - contract-refused - contract-settled - contract-not-remindable - contract-files-not-kept - contract-withdrawal-pending - esign-unavailable - identity-unavailable title: ErrorCode description: >- What went wrong, as a value to branch on. Published vocabulary, stated here rather than shared with any other product of ours: these are read by integrations we do not control, so a name here means what it says for as long as the endpoint answering it exists. One code names one cause, so a status carrying several causes is told apart by the code and never by the message. Codes are added as new causes become reachable; an integration therefore treats an unrecognised code as the status it arrived at. securitySchemes: HTTPBearer: type: http scheme: bearer ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.