CORA API

The routes CORA calls

All routes are under https://api.fortresstech.io/v1 and use the organization’s API key in the x-api-key header. The paths below are relative to that base URL.

CORA endpoints

Route	What it does
`GET /compliance-documents/manifest`	Read every document type with its current definition (fields, mappings, rules), `definitionVersion` and `definitionStatus`, independent of any application. Read it before any upload to build one Blueprint per document type and `definitionVersion`. One version per document type; Fortress tells Fission Labs when a definition changes (no event). The API key needs the `compliance-documents: read` permission (`401` without an `x-api-key`; `403` when the key is unknown or lacks the permission).
`GET /compliance-documents/applications/{applicationId}/bundle`	Read the application bundle: requirements, the document types Fortress asks each applicant for with their `documentTypeKey`, current `definitionVersion` and `required` (the label, taxonomy domain, recognition text and definition content only with `include`; the manifest is the dictionary for them), and documents with status, extracted fields and review result. The API key needs the `compliance-documents: read` permission (`401` without an `x-api-key`; `403` when the key is unknown or lacks the permission). `404 APPLICATION_NOT_FOUND` when the application is missing or not in the key’s organization or properties.
`POST /documents/{documentId}/results`	Write a document’s status, with its extracted fields and review results. The API key needs the `documents: create` permission. CORA writes every document status except `NOT_YET_REVIEWED` and `APPROVED` (Fortress only, `403`). `404 DOCUMENT_NOT_FOUND` when the document is unknown, not in the key’s organization, not `COMPLETED`, has no applicant or no document type, or the body’s `applicationId` is not the document’s application. Calls with the same `reviewResult.runId` merge (`extractedFields` by `canonicalName`, `checks` by `checkId`, `computed` by `name`, `quality` by key; properties not sent keep their stored values); a new `runId` replaces the run, and properties not sent are cleared; `reasonCodes` are always replaced. No array size limits, only the request size limit (a little under 6 MB at the gateway). No transition rules beyond the `409`s. The requirement status is derived when the bundle is read. CORA acts on each document’s status; the requirement status is the summary (the most urgent state first). A requirement can be `WAITING_FOR_COMPLIANCE` while one of its documents is `WAITING_FOR_APPLICANT`, so nudge and pick up work per document. A failed document that needs a new upload is `REJECTED`; it no longer counts, so the requirement goes back to `AWAITING_UPLOAD` when nothing else counts or it was the only counting document of a required type. A `409` means Fortress refused the write: stop, re-read the bundle and continue from Fortress’ state. Codes, first match wins: `DOCUMENT_REMOVED`, `COMPLIANCE_REVIEW_OPEN`, `STATUS_SET_BY_USER` (also after a review closed with `NONE` on a document staff decided earlier), `DOCUMENT_ALREADY_VALIDATED` (the document is already `VALIDATED_BY_CORA`; any further write is refused and a new upload is a new document; a re-run after `REJECTED` is allowed). Fortress is still aligning `DOCUMENT_ALREADY_VALIDATED`, merging `computed` by name and the requirement status precedence with Fission Labs (CORA).
`POST /applications/{applicationId}/cancel`	Ask Fortress to cancel the application (`CADENCE_EXPIRED`, once the applicant has gone longer than the property’s `cadencePolicy.expireAfterLastTouchpoint` (7 days by default) without interaction after the last touchpoint, or `APPLICANT_REQUESTED`). The API key needs the `applications: cancel` permission; `applications: create` does not allow cancelling.
`GET /agents/{agentKey}/state?propertyId={propertyId}`	Read whether an agent (`cora` or `leslie`) is enabled for a property (`propertyId`, `agentKey`, `isEnabled`, `updatedAt`). A property never configured returns `isEnabled: false`, `updatedAt: null`. For `cora` it also returns `cadencePolicy`, the outreach timing CORA executes (the property’s stored policy, or the baseline seed when none was set or the property has no CORA configuration; not returned for `leslie`). `cadencePolicy.isFallback` is read-only: `true` for that default, `false` for a stored policy. Staff set it in Fortress; there is no partner write. Read it on startup and after a missed `agent.state_changed` webhook. The API key needs the `agents: read` permission (`401` without an `x-api-key`; `403` when the key is unknown or lacks the permission). `404 AGENT_NOT_FOUND` for any other `agentKey`; `404 PROPERTY_NOT_FOUND` when the property is missing or not the key’s. Branch on `code`, not `message`.
`GET /applications/{applicationId}/full`	Read the application in one call, straight from the Fortress database: the application, its household and every live applicant with its customer, addresses, jobs, spouse and minor record, its `incomes[]` and `assets[]` lines (the `/incomes` and `/assets` vocabulary) and deductions. It carries only the values the taxonomy compares documents against; each manifest mapping’s `applicationSource` names where. The API key needs `applications: full-read` (granted by name) to open the route; its `customers`, `incomes`, `assets`, `deductions` and `sensitive` grants add the matching sections (absent otherwise). With `sensitive: read` the full SSN, passport, state id, alien, bank account and SSA claim numbers come inline, encrypted for the partner as on `/sensitive`. Documents stay on the bundle. `404 APPLICATION_NOT_FOUND` when the application is missing or outside the key’s organization or properties.
`GET /sensitive/applications/{applicationId}`	Read the full Social Security, passport and alien registration numbers of every person on the application, and the institution and account number of every bank account `/assets` returns, each encrypted for your partner (how to decrypt). `null` when Fortress has no usable value. Join `people[]` by `customerId` or `applicantId` and `assets[]` by `assetId`. `403` until your API key is enabled for sensitive values and Fortress has given you your secret; `404 APPLICATION_NOT_FOUND` as for the bundle.
`POST /webhooks/trigger`	Receive an example delivery of a CORA event on demand, sent only to the `cora` subscriptions of the property you name that list that event type, to test the receiver. The payloads are examples, not real data. See Testing your receiver.

Existing Fortress routes CORA uses

Route	What CORA uses it for
`GET /applications/{applicationId}`	Read the application.
`GET /households/{householdId}`	Read the household.
`GET /customers`	List the applicants: names, contact details, consent and language.
`POST /messages`	Send a message to the applicant.
`GET /messages/{messageId}`	Read an applicant’s reply after `message.received`.
`GET /documents/{documentId}/downloadUrl`	Get a short-lived URL to download the uploaded file.