cURL

curl --request POST --fail-with-body --max-time 30 \
  "${AMLOK_API_BASE_URL}/v1/documents" \
  --header "Authorization: Bearer ${AMLOK_API_KEY}" \
  --header "Accept: application/json" \
  --header 'Idempotency-Key: idem_example_1001' \
  --form 'file=@statement-2026-09.pdf' \
  --form 'subject_id=biz_example' \
  --form 'document_type=bank_statement' \
  --form 'period_start=2026-09-01' \
  --form 'period_end=2026-09-30'

import os
import requests

base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
 'Idempotency-Key': 'idem_example_1001'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]

with open("statement-2026-09.pdf", "rb") as file:
    response = requests.post(
        base_url + "/v1/documents", headers=headers,
        files={"file": ("statement-2026-09.pdf", file, "application/pdf")},
        data={'subject_id': 'biz_example',
 'document_type': 'bank_statement',
 'period_start': '2026-09-01',
 'period_end': '2026-09-30'},
        timeout=30, allow_redirects=False,
    )
response.raise_for_status()
print(response.json())

import { readFile } from "node:fs/promises";

const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
  "Accept": "application/json",
  "Idempotency-Key": "idem_example_1001"
};
headers.Authorization = `Bearer ${apiKey}`;
const body = new FormData();
body.set("file", new Blob([await readFile("statement-2026-09.pdf")], { type: "application/pdf" }), "statement-2026-09.pdf");
body.set("subject_id", "biz_example");
body.set("document_type", "bank_statement");
body.set("period_start", "2026-09-01");
body.set("period_end", "2026-09-30");
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/documents", {
  method: "POST", headers,
  redirect: "error", signal: AbortSignal.timeout(30000),
  body,
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());

{
  "data": {
    "id": "doc_upload_example",
    "object": "document",
    "subject_id": "biz_example",
    "created_at": "2026-10-23T14:00:00Z",
    "updated_at": "2026-10-23T14:00:00Z",
    "record_version": 1,
    "source_refs": [],
    "data_status": "pending",
    "missing_fields": [],
    "schema_version": "1.4.2",
    "client_reference": "app-1029",
    "document_type": "bank_statement",
    "file_name": "statement-2026-09.pdf",
    "mime_type": "application/pdf",
    "byte_size": 123456,
    "sha256": "sha256_example",
    "storage_reference": "evidence_example",
    "period_start": "2026-09-01",
    "period_end": "2026-09-30",
    "issued_on": "2026-10-01",
    "issuer": "Example Bank",
    "page_count": 5,
    "extraction_status": "pending",
    "extraction_model_version": "statement-parser-v1",
    "extraction_confidence": null,
    "review_status": "not_reviewed",
    "retention_policy_id": "evidence-policy-v1",
    "stop_reason": null
  },
  "meta": {
    "request_id": "req_example",
    "schema_version": "1.4.2",
    "generated_at": "2026-10-23T14:00:00Z",
    "data_status": "pending"
  }
}

Identity

Upload document

Upload permitted evidence.

Required scope: documents:write. Validate file content; poll document extraction state. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt.

POST

documents

cURL

curl --request POST --fail-with-body --max-time 30 \
  "${AMLOK_API_BASE_URL}/v1/documents" \
  --header "Authorization: Bearer ${AMLOK_API_KEY}" \
  --header "Accept: application/json" \
  --header 'Idempotency-Key: idem_example_1001' \
  --form 'file=@statement-2026-09.pdf' \
  --form 'subject_id=biz_example' \
  --form 'document_type=bank_statement' \
  --form 'period_start=2026-09-01' \
  --form 'period_end=2026-09-30'

import os
import requests

base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
 'Idempotency-Key': 'idem_example_1001'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]

with open("statement-2026-09.pdf", "rb") as file:
    response = requests.post(
        base_url + "/v1/documents", headers=headers,
        files={"file": ("statement-2026-09.pdf", file, "application/pdf")},
        data={'subject_id': 'biz_example',
 'document_type': 'bank_statement',
 'period_start': '2026-09-01',
 'period_end': '2026-09-30'},
        timeout=30, allow_redirects=False,
    )
response.raise_for_status()
print(response.json())

import { readFile } from "node:fs/promises";

const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
  "Accept": "application/json",
  "Idempotency-Key": "idem_example_1001"
};
headers.Authorization = `Bearer ${apiKey}`;
const body = new FormData();
body.set("file", new Blob([await readFile("statement-2026-09.pdf")], { type: "application/pdf" }), "statement-2026-09.pdf");
body.set("subject_id", "biz_example");
body.set("document_type", "bank_statement");
body.set("period_start", "2026-09-01");
body.set("period_end", "2026-09-30");
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/documents", {
  method: "POST", headers,
  redirect: "error", signal: AbortSignal.timeout(30000),
  body,
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());

{
  "data": {
    "id": "doc_upload_example",
    "object": "document",
    "subject_id": "biz_example",
    "created_at": "2026-10-23T14:00:00Z",
    "updated_at": "2026-10-23T14:00:00Z",
    "record_version": 1,
    "source_refs": [],
    "data_status": "pending",
    "missing_fields": [],
    "schema_version": "1.4.2",
    "client_reference": "app-1029",
    "document_type": "bank_statement",
    "file_name": "statement-2026-09.pdf",
    "mime_type": "application/pdf",
    "byte_size": 123456,
    "sha256": "sha256_example",
    "storage_reference": "evidence_example",
    "period_start": "2026-09-01",
    "period_end": "2026-09-30",
    "issued_on": "2026-10-01",
    "issuer": "Example Bank",
    "page_count": 5,
    "extraction_status": "pending",
    "extraction_model_version": "statement-parser-v1",
    "extraction_confidence": null,
    "review_status": "not_reviewed",
    "retention_policy_id": "evidence-policy-v1",
    "stop_reason": null
  },
  "meta": {
    "request_id": "req_example",
    "schema_version": "1.4.2",
    "generated_at": "2026-10-23T14:00:00Z",
    "data_status": "pending"
  }
}

Required scope: documents:write Upload permitted evidence. Required scope: documents:write. Validate file content; poll document extraction state. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt. Product scope · Processing lifecycle · Errors

Authorizations

Authorization

string

header

required

Server-to-server API key bound to exactly one workspace, institution tenant and environment. No caller-supplied workspace override is accepted. Do not use in public browser code.

Headers

X-Request-ID

string

Optional caller correlation ID; the response includes AMLOK request_id.

Idempotency-Key

string

required

Reuse for retries of the same intended command and identical payload. Retention: 24 hours.

Body

multipart/form-data

file

required

Request field from the endpoint contract.

subject_id

string

required

Business or person to which this record relates.

Minimum string length: 1

document_type

enum<string>

required

Category of evidence.

Available options:

identity,

proof_of_address,

bank_statement,

financial_statement,

tax_return,

corporate_registry,

ownership,

loan_agreement,

lien_report,

invoice,

other

period_start

string<date>

First date covered by the document.

period_end

string<date>

Last date covered by the document, inclusive.

requirement_id

string

Optional missing-evidence requirement in this subject and workspace. The upload is attached to the requirement; AMLOK validates evidence and resumes the parent when accepted.

Minimum string length: 1

Response

Upload permitted evidence. Accepted work is not yet complete.

data

document · object

required

Evidence file metadata and extraction context. Population depends on source and tenant entitlement.

Show child attributes

Get started

Endpoints

Essentials

Upload document

Authorizations

Headers

Body

Response