> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://developer.fortresstech.io/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.fortresstech.io/_mcp/server. # Read everything about an application GET https://api.fortresstech.io/v1/applications/{applicationId}/full One application in one read, straight from the Fortress database (no search index, no sync delay), shaped for integration: the application, its household and every live applicant with everything reported for them — one `customer` object (who the adult is and what they answered on this application), `addresses[]` and `jobs[]` tagged by `kind`, `spouse`, `minor`, the income and asset answers as `incomes[]` and `assets[]` lines in the vocabulary of [`GET /incomes`](/api-reference/incomes/list-incomes) and [`GET /assets`](/api-reference/assets/list-assets), and `deductions[]`. Every object carries the values the CORA taxonomy compares documents against and the ids a partner joins on, nothing else: no internal columns, audit trails, staff notes, row ids or the portal's form state; lookup ids come as names/codes, dates as `YYYY-MM-DD`, amounts as numbers. Each mapping of the document-type definitions (`GET /compliance-documents/manifest`) names, in `applicationSource`, the path in this response it compares against. `applicationSource` is a reading guide for a person or a model, not a query language: it starts with the path to the entity (`applicants[].incomes[]`, `applicants[].customer`), may narrow the lines with `where = ` (`and` adds a condition, `or` / `/` list alternatives), and names the fields to read after `→`, or ends in a field (`applicants[].customer.maritalStatus`). A `;` starts either another path to read as well (it begins with `applicants[]`, as the minors' names after the adults') or a note (`compare the last 4`). Anything in parentheses, and any item after `→` that is more than a field name (`encrypted for the partner`), is a note too (`(adults)`, `(several entries of one type add up)`). **Permissions pick the sections.** The route itself needs `applications: full-read` (granted by name; a `*` wildcard does not open it). The key's other grants add sections, and a section the key lacks is **absent**, not `null`: | Grant | Section | | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `applications: full-read` | `application`, `household`, `applicants[]` (id, type, relationships, citizenship) | | `customers: read` | `applicants[].name`, `applicants[].citizenshipStatus`, `customer`, `minor`, `addresses[]`, `jobs[]`, `spouse` | | `incomes: read` | `applicants[].incomes[]` | | `assets: read` | `applicants[].assets[]` | | `deductions: read` | `applicants[].deductions` | | `sensitive: read` | the full Social Security, passport, state id and alien registration numbers on `customer` and `minor`, `institution` / `accountNumber` on the asset lines, and `claimNumber` (the SSN plus a suffix) on the Social Security and SSI income lines — only when the key names a partner; a key granted `sensitive: read` without a partner name gets `200` with these fields absent and no error | A service wildcard (`*: [read]`) opens `customers`, `incomes`, `assets` and `deductions` as it does on the per-resource routes; it never opens the route itself nor `sensitive`. Income figures stored outside the lines belong to the `incomes` section too and are absent without it: `applicants[].annualIncome`, `customer.annualIncome` and `annualSalary` on each job. `sensitive: read` adds fields to the sections the key already has: the adults' numbers sit on `customer` and the minors' on `minor` (so they need `customers: read` too), the account values on the asset lines (so they need `assets: read`), the claim numbers on the income lines (so they need `incomes: read`). There is no last-four companion for the Social Security number: a document's `ssn_last4` is compared after decrypting the full value. With `sensitive: read` every sensitive value is **encrypted for the calling partner** exactly as on [`GET /sensitive/applications/{applicationId}`](/api-reference/sensitive/get-application-sensitive-values) (AES-256-GCM, key = SHA-256 of the partner secret, Base64 of `[IV 16 bytes][AuthTag 16 bytes][ciphertext]`; see [Sensitive values](/ai-team-members/cora/sensitive-values)); the `...LastFour` companions are plain and always present. The response carries `Cache-Control: no-store`. Documents, requirements and review results are not here: read the [bundle](/api-reference/compliance-documents/get-application-bundle). An applicant's `id` is the `applicantId` the bundle's requirements name. Authenticate with the `x-api-key` header. Reference: https://developer.fortresstech.io/api-reference/applications/get-application-full ## Authentication - `x-api-key` header (required) — API Key authentication via header ## Request ### Path parameters - `applicationId` (string, required) — The application. ## Response ### 200 The application's data, with the sections the key is granted. - `any` ## Errors ### 401 Unauthorized Error No `x-api-key` header: API Gateway refuses the request before it reaches Fortress (body `{"message": "Unauthorized"}`). Also: Fortress refused a key that passed the gateway. - `any` ### 403 Forbidden Error Either the floo gateway refused the x-api-key (unknown, or not granted `applications: full-read` by name; the request never reaches Fortress, so the body is API Gateway's default `Message`), or Fortress refused it: `FULL_READ_NOT_GRANTED` (the key is not granted `applications: full-read`; Fortress checks the grant again) or `SENSITIVE_DATA_NOT_ENABLED` (the key is granted `sensitive: read` but Fortress has not given the partner a secret yet). - `GetApplicationFullRequestForbiddenError` - GetApplicationFullRequestForbiddenError0 - GetApplicationFullRequestForbiddenError1 ### 404 Not Found Error Application not found, or not in the API key's organization or properties (the same `{code, message}` body for both). A path id that is not a UUID is refused before Fortress is asked, with a problem-details body instead. - `GetApplicationFullRequestNotFoundError` - GetApplicationFullRequestNotFoundError0 - GetApplicationFullRequestNotFoundError1 ### 502 Bad Gateway Error Fortress could not answer right now (the backend could not be reached, did not answer in time, or could not check the API key or reach the partner secret). Retry later. - `any` ## Types ### GetApplicationFullRequestForbiddenError0 - `code` (enum, required) - Allowed values: `APPLICATION_NOT_FOUND` - `message` (string, optional) ### GetApplicationFullRequestForbiddenError1 - `Message` (string, required) ### GetApplicationFullRequestNotFoundError0 - `code` (enum, required) - Allowed values: `APPLICATION_NOT_FOUND` - `message` (string, optional) ### GetApplicationFullRequestNotFoundError1 RFC 7807 problem details, for a path id that is not a UUID. - `title` (string, required) - `status` (integer, required) - `type` (string, optional) - `detail` (string, optional) - `instance` (string, optional) ## Examples **SDK Code** ```python applications_getApplicationFull_example import requests url = "https://api.fortresstech.io/v1/applications/applicationId/full" headers = {"x-api-key": ""} response = requests.get(url, headers=headers) print(response.json()) ``` ```javascript applications_getApplicationFull_example const url = 'https://api.fortresstech.io/v1/applications/applicationId/full'; const options = {method: 'GET', headers: {'x-api-key': ''}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go applications_getApplicationFull_example package main import ( "fmt" "net/http" "io" ) func main() { url := "https://api.fortresstech.io/v1/applications/applicationId/full" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("x-api-key", "") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby applications_getApplicationFull_example require 'uri' require 'net/http' url = URI("https://api.fortresstech.io/v1/applications/applicationId/full") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Get.new(url) request["x-api-key"] = '' response = http.request(request) puts response.read_body ``` ```java applications_getApplicationFull_example import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.get("https://api.fortresstech.io/v1/applications/applicationId/full") .header("x-api-key", "") .asString(); ``` ```php applications_getApplicationFull_example request('GET', 'https://api.fortresstech.io/v1/applications/applicationId/full', [ 'headers' => [ 'x-api-key' => '', ], ]); echo $response->getBody(); ``` ```csharp applications_getApplicationFull_example using RestSharp; var client = new RestClient("https://api.fortresstech.io/v1/applications/applicationId/full"); var request = new RestRequest(Method.GET); request.AddHeader("x-api-key", ""); IRestResponse response = client.Execute(request); ``` ```swift applications_getApplicationFull_example import Foundation let headers = ["x-api-key": ""] let request = NSMutableURLRequest(url: NSURL(string: "https://api.fortresstech.io/v1/applications/applicationId/full")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```