Collection requests — API quick start

1. Create a scoped credential

Sign in as the installation Administrator and open Developer / API. Select operation scopes, enabled record types and optional record IDs. Copy the key once and store it in your server’s secret manager. Use a separate credential for each installation and integration.

This is an explicit Administrator delegation to the installation’s background integration. The API checks the current local role policy and uses the trusted NetSuite callback to verify each target record. Production, Sandbox and Release Preview remain separate.

2. Create a request

Use the installation and document category IDs from the authenticated Setup Center and record workspace. The record must already be saved and its type enabled. Save the following as request.json, replace placeholders, then run the command. Keep the same payload and idempotency key when retrying.

{
  "target": {
    "installationId": "<installation UUID>",
    "recordType": "PURCHASE_ORDER",
    "recordId": "<saved record internal ID>"
  },
  "title": "Please submit supporting documents",
  "message": "Submit the requested documents using this secure link.",
  "recipientEmail": "recipient@example.com",
  "requestedCategoryIds": [
    "<category UUID>"
  ],
  "expiresAt": "<future ISO 8601 UTC timestamp>",
  "maximumFiles": 10,
  "maximumBytes": 104857600,
  "requireEmailOtp": true,
  "uploadOnly": true,
  "allowViewOwnUploads": true
}

curl "$DOCLAYER_ORIGIN/v1/integrations/upload-requests" \
  -H "Authorization: Bearer $DOCLAYER_API_KEY" \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: collection-order-20261010-001' \
  --data @request.json

The response contains id, url, expiresAt, invitationStatus and replayed. The specified recipient receives an invitation automatically and opens its private email link without another code. Copied response links retain email verification. Files are uploaded directly to private storage and become available only after verification and malware scanning.

3. Query submissions

GET /v1/integrations/upload-requests/{id} requires installationId, recordType and recordId as query parameters. Requests are scoped to the exact record and creating credential. The files array reports processing states; AVAILABLE means the file can be used in the record workspace.

List requests with the same target parameters. Use limit and the returned nextCursor for pagination. DELETE revokes a request. POST to /{id}/link regenerates its link and requires Idempotency-Key.

Retries, errors and limits

400: check the payload and Idempotency-Key. 403: check credential scopes, record access and installation policy. 409 IDEMPOTENCY_KEY_REUSED: use the original payload or a new key. 429: honor Retry-After. Retry a transport failure or 5xx with the same key and unchanged payload.

Invitation status is independent of request creation. FAILED means the request exists and its returned link can still be shared with the specified recipient. Regenerated links are not emailed automatically. Revoking an API key stops future integration calls; separately revoke its collection requests to stop guest submissions.

Maximum file size is the lower of tenant policy and the deployment’s verified processing capacity. A request’s total byte limit does not increase the per-file limit. Initial processing capacity remains 100 MiB. No webhook, SDK or record line/field attachment API is included.

JavaScript and Python

const response = await fetch(process.env.DOCLAYER_ORIGIN + '/v1/integrations/upload-requests', {
  method: 'POST',
  headers: { Authorization: 'Bearer ' + process.env.DOCLAYER_API_KEY,
    'Content-Type': 'application/json', 'Idempotency-Key': operationKey },
  body: JSON.stringify(request)
});
if (!response.ok) throw new Error('Request failed: ' + response.status);
const result = await response.json();

import os, requests
response = requests.post(os.environ['DOCLAYER_ORIGIN'] + '/v1/integrations/upload-requests',
    headers={'Authorization': 'Bearer ' + os.environ['DOCLAYER_API_KEY'],
             'Idempotency-Key': operation_key}, json=request_body, timeout=30)
response.raise_for_status()
result = response.json()