Dociya API

Overview

The Dociya API is the backbone of the Dociya app: every document, deadline, chat turn, and wallet card a household sees is served through it. This reference documents the real, deployed surface — every request and response shape matches production exactly.

Base URL

All requests are made over HTTPS against a single origin. There is no versioning prefix yet — the API is pre-1.0 and evolves additively (new optional fields, never silently-renamed ones).

https://api.dociya.com

Quickstart

Every request (aside from sign-up, sign-in, and a handful of public preview endpoints) carries a bearer access token — see Authentication. Once you have one, list the signed-in household's documents:

curl https://api.dociya.com/documents \
  -H "Authorization: Bearer $DOCIYA_ACCESS_TOKEN"

Design principles

A few invariants hold across every endpoint in this reference — worth knowing before you integrate against any of them:

Never guessed. Extraction returns null rather than an invented value. If a field isn't confidently known, it's absent, not wrong.
Masked by default. Sensitive values (SSNs, full card numbers, DOBs) come back as •••• + last 4 in every list/detail response. Full values require a separate, biometric-gated reveal path.
404, never 403. A resource that exists but belongs to another household returns 404 Not Found — never 403 Forbidden. See Errors & conventions.
Human-in-the-loop. Nothing that changes real state outside Dociya (a renewal, a payment) is ever executed directly — the API only ever prepares it for a person to approve.

Note

This reference covers the primary resource surface — documents, deadlines, chat, wallet cards, shares, and the growth/connector endpoints (referrals, DigiLocker, brand logos). Account, billing, and household-settings endpoints exist but aren't documented here yet.