DKBSignDocs

Core concepts

Document vault (EDM)

Folders, versions, legal hold, SHA-256 sealing, time-limited shares, and compliance reports.

Library

Organise files with typologies and folders. Upload with POST /api/edm/documents (multipart). folder_id is required. Optional: typology_id, name, status (default draft), metadata (JSON object string), tags (JSON array or CSV), client_ref, contract_ref, transaction_ref.

List with folder_id, typology_id, status (draft|in_signature|signed|sealed), tag, limit (1–200), offset. Full-text search is GET /api/edm/search?q= (plus type, signer, date and sealed-date ranges, consent).

Versions, restore, preview, and content download hang off /api/edm/documents/{document_id}. A new version is multipart file + optional note.

Rights

Permissions are read, download, deposit, delete, and manage. Grant them on a folder or a document (subject_type = role or user). GET /api/edm/permissions/effective returns the caller’s flags for exactly one target. A company admin has full access in their organisation.

Sealing

POST /api/edm/documents/{id}/seal seals the current version (SHA-256, optional qualified timestamp). After that the document is immutable: update, delete, or a new version returns 409 document_sealed. Sealing again returns 409 already_sealed. Verify with GET .../verify (ok, hashes) and fetch the attestation with GET .../certificate.

Legal hold: POST .../legal-hold with { "hold": true }. Retention purge is POST /api/edm/lifecycle/purge/run (company-admin; held documents are skipped). Integrity across the vault: POST /api/edm/vault/integrity/run.

Shares

POST /api/edm/documents/{id}/shares creates a time- or usage-limited link:

  • scope — internal (default) or external
  • expires_in_hours — clamped to the configured max (default TTL 72h)
  • max_uses — optional use cap
  • password — optional (PBKDF2)

The raw token is returned once (only the SHA-256 is stored). Recipients open GET /api/edm/shared/{token} (optional password query, no Bearer) and receive a 300-second signed download URL.

Invalid, revoked, expired, or exhausted tokens all return 404 share_invalid (same message). Wrong or missing password → 401 share_password_required.

Errors

Vault errors look like:

json
{ "error": { "code": "document_sealed", "message": "Document scellé : modification et suppression interdites." } }

code is a stable English key; message is a French diagnostic. Do not treat those as the gateway status / message envelope. Other codes: forbidden, not_found, validation_error, versioning_disabled, already_sealed, share_invalid.