> ## Documentation Index > Fetch the complete documentation index at: https://docurise.io/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get a document > Read one document with its expiry, protection summary and the revision (ETag) to send back when you change it ## OpenAPI ````yaml api-reference/openapi.yaml GET /api/preview/documents/{id} openapi: 3.1.0 info: title: DocuRise Public API version: preview description: > Programmatic access to DocuRise. **This is a preview API.** Every path is versioned under `/api/preview/` and carries no compatibility guarantee while it is in preview: fields, values and error codes may be added, changed or removed. Once the contract stabilizes it will be promoted to `/api/v1/`. See the [changelog](/changelog) for what changed and when. ### Access Every route requires: 1. A valid API key (see Authentication below). 2. The calling account's plan must be **Iconic or above**. 3. During the preview the API is available to some accounts only, whatever the plan. Accounts without access get a `404` from every route below; if you expect access, check with your DocuRise contact. Generate and manage keys from **Settings → Developers** in the dashboard. ### Idempotency `POST` endpoints that create a resource require an `Idempotency-Key` header. Reusing the same key with the same request body replays the original response (same status code, same body) instead of creating a second resource — safe to retry on timeout or connection loss. A key is remembered for 7 days; after that the same key is treated as a new request. Reusing the same key with a **different** body is rejected with `IDEMPOTENCY_KEY_CONFLICT`. Generate a fresh key (a UUID or ULID is fine) per logical operation, not per HTTP attempt. One exception: `POST /api/preview/tags` takes no `Idempotency-Key`. Creating the same tag name twice changes nothing (the second call returns the existing tag with `created: false`), so a retry is always safe. Another exception: `POST /api/preview/segments/preview` takes no `Idempotency-Key`. It saves nothing, so repeating it is always safe. ### Response compatibility Responses may gain additional fields over time, and `type`/`code`-style enum values (for example a future `LeadFormQuestion.type` member, or a new error `code`) may gain new members. Always ignore fields and enum values you don't recognize rather than treating them as errors — this is what makes every additive change under `preview` non-breaking. A field absent from a response is not always the same as a field present with value `null`. A field whose type never includes `null` is omitted when it doesn't apply — it is never sent as `null` (for example, `retryAfterSeconds` is left out entirely when there's no backoff hint, not set to `null`). A field whose type explicitly allows `null` uses it to mean something real and distinct from "not present" (for example, `expiresAt: null` on a document means it has no fixed expiry date, not "unknown" or "not applicable"). All field names use `camelCase` — `notionUrl`, `leadFormQuestions`, `collectName`, and so on — consistently across every request and response body. ### Identifiers `id` values are opaque strings. Store and compare them as unstructured tokens — don't parse them, validate their format, or assume anything about their length or character set. ### Errors Every error response has the same shape: ```json { "error": { "code": "STRING", "message": "human-readable", "retryable": false } } ``` Switch on `code`, not `message` — `message` is free text for logs/debugging and may be reworded without notice; `code` is the stable contract. `retryable` tells you whether the same request is safe to retry as-is; when present, `retryAfterSeconds` is a concrete backoff hint. A request body that contains a NUL character (`\u0000`), in a string value or in a property name, is refused with `400 VALIDATION_ERROR` before anything is saved. ### Rate limiting 60 requests/minute per account across all `/api/preview/*` routes, regardless of how many keys that account has. Exceeding it returns `429` with a `Retry-After` header. Separately, an account can have at most 10 requests running at the same moment across these routes, however many keys it has. A request that would be the eleventh returns `429` with `code: TOO_MANY_CONCURRENT_REQUESTS` and `Retry-After: 1`; wait for one of your requests to finish and retry. This limit counts requests that have not finished, so it can apply even while you are under 60 requests per minute. contact: name: DocuRise url: https://docurise.io servers: - url: https://docurise.io description: Production security: - apiKey: [] tags: - name: Documents description: >- Create documents (a Notion page, a post or a lead-capture form), list or read the documents you own, publish drafts, and change their status, expiry and email protection. - name: Analytics description: >- Read aggregate view, visitor, lead and conversion numbers for one of your documents, split by traffic channel, compared with the previous period, or as a form funnel, and rank all of your documents by views, visitors or leads. - name: Folders description: Read your folders and courses, with item counts. - name: Products description: Read your product catalog (read-only). - name: Audiences description: >- List your tags and groups with contact counts, create a group from a rule, count who a rule would match, and read one group with its rule. Counts only; no member data is ever returned. - name: Contacts description: >- Add or remove a tag on one of your contacts. Contact details are never returned. - name: Email description: >- Read email broadcasts, their aggregate delivery numbers, and automations. Email only; Kakao is not included. - name: Instagram description: >- Create, read, edit, pause and resume Instagram comment-to-DM automation rules. - name: Account description: Inspect the API key you are calling with. paths: /api/preview/documents/{id}: parameters: - name: id in: path required: true description: The document id. schema: type: string format: uuid get: tags: - Documents summary: Get a document description: > Returns one document you own: everything `GET /api/preview/documents` returns, plus its description, expiry, a summary of how it is protected and the `revision` to send back when you change it. Requires the `documents:read` scope. `status` is what visitors get, the same value `GET /api/preview/documents` shows: `live`, `draft`, `inactive`, or `expired` for a live document whose fixed expiry has passed. A paused (`inactive`) or `draft` document keeps that status even after its expiry date. The protection summary says **how** the document is gated: the access mode, whether email and email verification are required, whether a password is set, and the two allow lists (`allowedEmails`, `allowedDomains`). The password is never returned. Change the email and allow-list settings with `PATCH` on this path; the password and the access mode are changed in the dashboard. `revision` identifies this version of the document. It is also sent as the `ETag` response header; send the `revision` back **in the request body** when you `PATCH` (not as `If-Match`). A key needs `documents:read` to read the current revision (ETag) and `documents:write` to change the document; give an automation both scopes. A document that does not exist, is not yours, or whose id is not a valid UUID all return the same `404 DOCUMENT_NOT_FOUND`. operationId: getDocument responses: '200': description: The document. headers: ETag: description: >- The `revision`, quoted. Send the `revision` in the `PATCH` body, as the plain timestamp or this header value copied as is, quoted or in the weak `W/"..."` form (a gateway or proxy may turn the ETag weak when it compresses the response). Do not send it as `If-Match`. schema: type: string example: '"2026-10-04T01:02:03.456Z"' content: application/json: schema: $ref: '#/components/schemas/DocumentDetail' '401': $ref: '#/components/responses/Unauthorized' '403': description: >- `PAST_DUE_RESTRICTED`, `PLAN_REQUIRED` or `INSUFFICIENT_SCOPE` (the key lacks `documents:read`). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': $ref: '#/components/responses/DocumentNotFound' '429': $ref: '#/components/responses/RateLimited' '500': description: >- `INTERNAL_ERROR`: unexpected failure. Retryable; the cause is not returned. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '503': $ref: '#/components/responses/Unavailable' security: - apiKey: [] x-codeSamples: - lang: bash label: cURL source: > curl -i "https://docurise.io/api/preview/documents/7f1c0f7e-3c5e-4b1a-9d34-2f0a5b6c8d90" \ -H "Authorization: Bearer $DOCURISE_API_KEY" components: schemas: DocumentDetail: description: > A `DocumentSummary` plus description, expiry, a protection summary with the two allow lists, and the `revision`. `status` is the one visitors get (the same value as in the list, including `expired`). This is also the body a successful `PATCH /api/preview/documents/{id}` returns. allOf: - $ref: '#/components/schemas/DocumentSummary' - type: object required: - description - expiry - protection - revision properties: description: type: - string - 'null' description: The document's subtitle, or `null` when none is set. expiry: type: object required: - type - expiresAt - days properties: type: type: string enum: - none - fixed_date - relative description: >- `relative` expires per viewer, a number of `days` after they first open it. expiresAt: type: - string - 'null' format: date-time description: Set for `fixed_date`, otherwise `null`. days: type: - integer - 'null' description: Set for `relative`, otherwise `null`. description: When the document expires. protection: type: object description: >- How the document is gated. Change the email and allow-list fields with `PATCH`; the password and the access mode are read-only here. Never contains the password. required: - accessMode - requireEmail - requireEmailVerification - passwordProtected - allowedEmails - allowedDomains properties: accessMode: type: string enum: - public - specific description: >- `public` (anyone with the link) or `specific` (only allowed emails and domains). requireEmail: type: boolean description: Viewers are asked for an email (a lead gate). requireEmailVerification: type: boolean description: >- Whether a viewer must confirm their email by clicking a link we email them before opening the document. It only applies when an email gate is on (`requireEmail`, or `accessMode: specific`). passwordProtected: type: boolean description: >- Viewers must enter a password. The password itself is never returned. allowedEmails: type: array items: type: string format: email description: >- Lowercase email addresses allowed in (when `accessMode` is `specific`). allowedDomains: type: array items: type: string description: >- Lowercase bare domains allowed in (when `accessMode` is `specific`), exact match. revision: type: string description: >- Identifies this version of the settings (an ISO 8601 UTC timestamp, milliseconds). Also sent as the `ETag` header; send it back as `revision` in the body of `PATCH`. Treat it as opaque. example: id: 7f1c0f7e-3c5e-4b1a-9d34-2f0a5b6c8d90 title: Pricing deck kind: pdf status: live url: https://docurise.io/v/pricing-deck createdAt: '2026-09-30T12:00:00.000Z' updatedAt: '2026-10-01T08:30:00.000Z' expiresAt: '2026-12-31T00:00:00.000Z' description: Q4 pricing expiry: type: fixed_date expiresAt: '2026-12-31T00:00:00.000Z' days: null protection: accessMode: public requireEmail: true requireEmailVerification: false passwordProtected: false allowedEmails: [] allowedDomains: [] revision: '2026-10-01T08:30:00.000Z' ErrorResponse: type: object required: - error properties: error: type: object required: - code - message - retryable properties: code: type: string description: >- Stable machine-readable error code — switch on this, not `message`. message: type: string description: Human-readable detail. May change wording without notice. retryable: type: boolean description: Whether retrying the identical request may succeed. retryAfterSeconds: type: integer description: Present only when a concrete backoff hint applies. details: type: object description: > Present only for a few specific codes: - `PROTECTION_RULE_CONFLICT`: `{ rule: string }`, the protection rule that refused the request (`form`, `restricted_access`, `paid_lead_gate`, `free_lead_gate` or `form_no_access_controls`). Open-ended: tolerate new values. - `NEXT_POST_RULE_EXISTS`: `{ ruleId: string }`, the existing next-post rule. - `NOTION_FETCH_FAILED`: `{ notionErrorCode: string }`, one of `NOTION_ERROR_PRIVATE`, `NOTION_ERROR_NOT_FOUND`, `NOTION_ERROR_NETWORK`, `NOTION_ERROR_RATE_LIMIT`, `NOTION_ERROR_TEMPORARILY_UNAVAILABLE`, `NOTION_ERROR_PAGE_REJECTED`, `NOTION_ERROR_UNKNOWN`. - `HTML_REJECTED`: `{ reason: string }`, one of `too_large`, `css_rejected` or `invalid`. Open-ended: tolerate new values. - `CONDITION_NOT_SUPPORTED`: `{ field: string, path: string }`, the condition type that is not accepted and where it sits in the request. For a condition shape refused where it sits also `operator: string` and, when there is an equivalent operator for `requiredConditions`, `invertTo: string`. - `REFERENCE_NOT_FOUND`: `{ path: string, kind: string }`, where the unknown id sits in the request and what it refers to: `document`, `product`, `tier`, `cta`, `folder`, `broadcast` or `step`. Open-ended: tolerate new values. - `TAG_NOT_FOUND` (from a group rule): `{ tag: string }`, the tag name that does not exist. - `GROUP_REFERENCE_NOT_FOUND`: `{ groupIds: string[] }`, the group ids that are not in the account. - `GROUP_LIMIT_REACHED`: `{ limit: integer }`, the most groups an account can create through the API. description: >- The error. Every error response from the API has it: `code`, `message`, `retryable` and, for some codes, `retryAfterSeconds` and `details`. DocumentSummary: type: object required: - id - title - kind - status - url - createdAt - updatedAt - expiresAt properties: id: type: string format: uuid description: The document's id. title: type: string description: The document's title. kind: type: string enum: - notion - pdf - upload - post - form description: >- What the document is made of: `notion`, `pdf`, `upload` (a file you uploaded), `post` or `form`. status: type: string enum: - live - draft - inactive - expired description: >- The status: `live` (visitors can open it), `draft` (a post or form that is not published yet), `inactive` (turned off, by you or automatically, for example when a Notion page can no longer be read) or `expired` (its expiry date has passed). url: type: string format: uri description: The public share link. createdAt: type: string format: date-time description: When the document was created (RFC 3339, UTC). updatedAt: type: string format: date-time description: When the document was last changed (RFC 3339, UTC). expiresAt: type: - string - 'null' format: date-time description: >- The fixed expiry date, or `null` when there is none. A per-viewer (relative) expiry has no single date, so it is `null` here; see `expiry` on the single-document response. responses: Unauthorized: description: 'Missing, malformed, or revoked API key (`code: UNAUTHORIZED`).' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' DocumentNotFound: description: | `DOCUMENT_NOT_FOUND`: no such document for this account (unknown, malformed or someone else's id, all indistinguishable). Or `NOT_FOUND` if the API is not available to the account. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' RateLimited: description: >- Rate limited (`code: RATE_LIMITED`, always retryable): see the `Retry-After` header and `X-RateLimit-*` headers. Or too many requests running at once (`code: TOO_MANY_CONCURRENT_REQUESTS`, always retryable): `Retry-After` is `1` and there are no `X-RateLimit-*` headers. headers: Retry-After: schema: type: integer X-RateLimit-Limit: schema: type: integer X-RateLimit-Remaining: schema: type: integer X-RateLimit-Reset: schema: type: integer description: Unix timestamp (seconds) when the limit resets. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unavailable: description: | A server-side dependency is temporarily down (`RATE_LIMIT_UNAVAILABLE` or `SERVICE_UNAVAILABLE`). Not a problem with the request or key; always retryable — honor `retryAfterSeconds` when present. The group endpoints (`POST /segments`, `POST /segments/preview`, `GET /segments/{id}`) also return it when a very heavy rule could not be counted within about 10 seconds: simplify the rule or retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: apiKey: type: http scheme: bearer bearerFormat: dr_live__ description: | A key generated from Settings → Developers, sent as `Authorization: Bearer dr_live_<12 hex chars>_<64 hex chars>`. Keys carry explicit scopes — each endpoint states the one it requires. The full key is shown exactly once at generation time and cannot be retrieved again; only the `keyId` prefix is shown afterward. A revoked key fails auth on its very next request. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.