> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://developer.fortresstech.io/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.fortresstech.io/_mcp/server. # CORA API All routes are under `https://api.fortresstech.io/v1` and use the organization's API key in the `x-api-key` header. The paths below are relative to that base URL. ## CORA endpoints | Route | What it does | | ----------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`GET /compliance-documents/manifest`](/api-reference/compliance-documents/get-compliance-documents-manifest) | Read every document type with its current definition (fields, mappings, rules), `definitionVersion` and `definitionStatus`, independent of any application. Read it before any upload to build one Blueprint per document type and `definitionVersion`. One version per document type; Fortress tells Fission Labs when a definition changes (no event). The API key needs the `compliance-documents: read` permission (`401` without an `x-api-key`; `403` when the key is unknown or lacks the permission). | | [`GET /compliance-documents/applications/{applicationId}/bundle`](/api-reference/compliance-documents/get-application-bundle) | Read the application bundle: requirements, the document types Fortress asks each applicant for with their `documentTypeKey`, current `definitionVersion` and `required` (the label, taxonomy domain, recognition text and definition content only with `include`; the manifest is the dictionary for them), and documents with status, extracted fields and review result. The API key needs the `compliance-documents: read` permission (`401` without an `x-api-key`; `403` when the key is unknown or lacks the permission). `404 APPLICATION_NOT_FOUND` when the application is missing or not in the key's organization or properties. | | [`POST /documents/{documentId}/results`](/api-reference/documents/post-document-results) | Write a document's status, with its extracted fields and review results. The API key needs the `documents: create` permission. CORA writes every document status except `NOT_YET_REVIEWED` and `APPROVED` (Fortress only, `403`). `404 DOCUMENT_NOT_FOUND` when the document is unknown, not in the key's organization, not `COMPLETED`, has no applicant or no document type, or the body's `applicationId` is not the document's application. Calls with the same `reviewResult.runId` merge (`extractedFields` by `canonicalName`, `checks` by `checkId`, `computed` by `name`, `quality` by key; properties not sent keep their stored values); a new `runId` replaces the run, and properties not sent are cleared; `reasonCodes` are always replaced. No array size limits, only the request size limit (a little under 6 MB at the gateway). No transition rules beyond the `409`s. The requirement status is derived when the bundle is read. CORA acts on each document's status; the requirement status is the summary (the most urgent state first). A requirement can be `WAITING_FOR_COMPLIANCE` while one of its documents is `WAITING_FOR_APPLICANT`, so nudge and pick up work per document. A failed document that needs a new upload is `REJECTED`; it no longer counts, so the requirement goes back to `AWAITING_UPLOAD` when nothing else counts or it was the only counting document of a required type. A `409` means Fortress refused the write: stop, re-read the bundle and continue from Fortress' state. Codes, first match wins: `DOCUMENT_REMOVED`, `COMPLIANCE_REVIEW_OPEN`, `STATUS_SET_BY_USER` (also after a review closed with `NONE` on a document staff decided earlier), `DOCUMENT_ALREADY_VALIDATED` (the document is already `VALIDATED_BY_CORA`; any further write is refused and a new upload is a new document; a re-run after `REJECTED` is allowed). Fortress is still aligning `DOCUMENT_ALREADY_VALIDATED`, merging `computed` by name and the requirement status precedence with Fission Labs (CORA). | | [`POST /applications/{applicationId}/cancel`](/api-reference/applications/cancel-application) | Ask Fortress to cancel the application (`CADENCE_EXPIRED`, once the applicant has gone longer than the property's `cadencePolicy.expireAfterLastTouchpoint` (7 days by default) without interaction after the last touchpoint, or `APPLICANT_REQUESTED`). The API key needs the `applications: cancel` permission; `applications: create` does not allow cancelling. | | [`GET /agents/{agentKey}/state?propertyId={propertyId}`](/api-reference/agents/get-agent-state) | Read whether an agent (`cora` or `leslie`) is enabled for a property (`propertyId`, `agentKey`, `isEnabled`, `updatedAt`). A property never configured returns `isEnabled: false`, `updatedAt: null`. For `cora` it also returns `cadencePolicy`, the outreach timing CORA executes (the property's stored policy, or the baseline seed when none was set or the property has no CORA configuration; not returned for `leslie`). `cadencePolicy.isFallback` is read-only: `true` for that default, `false` for a stored policy. Staff set it in Fortress; there is no partner write. Read it on startup and after a missed `agent.state_changed` webhook. The API key needs the `agents: read` permission (`401` without an `x-api-key`; `403` when the key is unknown or lacks the permission). `404 AGENT_NOT_FOUND` for any other `agentKey`; `404 PROPERTY_NOT_FOUND` when the property is missing or not the key's. Branch on `code`, not `message`. | | [`GET /applications/{applicationId}/full`](/api-reference/applications/get-application-full) | Read the application in one call, straight from the Fortress database: the application, its household and every live applicant with its customer, addresses, jobs, spouse and minor record, its `incomes[]` and `assets[]` lines (the `/incomes` and `/assets` vocabulary) and deductions. It carries only the values the taxonomy compares documents against; each manifest mapping's `applicationSource` names where. The API key needs `applications: full-read` (granted by name) to open the route; its `customers`, `incomes`, `assets`, `deductions` and `sensitive` grants add the matching sections (absent otherwise). With `sensitive: read` the full SSN, passport, state id, alien, bank account and SSA claim numbers come inline, encrypted for the partner as on `/sensitive`. Documents stay on the bundle. `404 APPLICATION_NOT_FOUND` when the application is missing or outside the key's organization or properties. | | [`GET /sensitive/applications/{applicationId}`](/api-reference/sensitive/get-application-sensitive-values) | Read the full Social Security, passport and alien registration numbers of every person on the application, and the institution and account number of every bank account `/assets` returns, each encrypted for your partner ([how to decrypt](/ai-team-members/cora/sensitive-values)). `null` when Fortress has no usable value. Join `people[]` by `customerId` or `applicantId` and `assets[]` by `assetId`. `403` until your API key is enabled for sensitive values and Fortress has given you your secret; `404 APPLICATION_NOT_FOUND` as for the bundle. | | [`POST /webhooks/trigger`](/api-reference/webhooks/trigger-webhook-event) | Receive an example delivery of a CORA event on demand, sent only to the `cora` subscriptions of the property you name that list that event type, to test the receiver. The payloads are examples, not real data. See [Testing your receiver](/ai-team-members/cora/events#testing-your-receiver). | ## Existing Fortress routes CORA uses | Route | What CORA uses it for | | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------ | | [`GET /applications/{applicationId}`](/api-reference/applications/read-application) | Read the application. | | [`GET /households/{householdId}`](/api-reference/households/read-household) | Read the household. | | [`GET /customers`](/api-reference/customers/list-customers) | List the applicants: names, contact details, consent and language. | | [`POST /messages`](/api-reference/messaging/send-message) | Send a message to the applicant. | | [`GET /messages/{messageId}`](/api-reference/messaging/read-message) | Read an applicant's reply after `message.received`. | | [`GET /documents/{documentId}/downloadUrl`](/api-reference/documents/read-document-download-url) | Get a short-lived URL to download the uploaded file. |