List Inbox Documents
GET/api/document-inbox
Return a unified, paginated, descending-by-created_at list combining customer PO, supplier invoice, vendor credit, and landed cost invoice OCR extractions. Each item is normalized to the same shape so a single mixed-type list can be rendered. Vendor credit extractions that are attached to an existing vendor credit (vendor_credit_attachment_id set) are excluded — they belong to that credit's documents, not the inbox.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
Example item:
{
"id": 42,
"type": "supplier_invoice",
"status": "pending_review",
"source": "email",
"source_email_from": "Jane Doe <jane@tenant.com>",
"source_email_forwarded_from": "orders-usa@tecmate.com",
"source_email_subject": "Fwd: Invoice Number-0002020",
"customer_name": null,
"supplier_name": "TecMATE",
"document_type": "invoice",
"detection_signals": [],
"auto_routed": false,
"ocr_header": {
"doc_number": {"value": "0002020", "confidence": 0.97},
"total": {"value": 37.06, "confidence": 0.97},
"tax_amount": {"value": 2.10, "confidence": 0.9},
"currency_code": {"value": "USD", "confidence": 0.99},
"doc_date": {"value": "2026-07-17", "confidence": 0.97},
"po_number": {"value": "PO-0671", "confidence": 0.95}
},
"confirmed_record": null,
"error_message": null,
"created_at": "2026-07-17T22:28:48.000000Z"
}
Sender fields:
source_email_from— the sender of the email that reached the intake address. For forwarded emails this is the forwarder, not the original contact.source_email_forwarded_from— the original sender parsed out of a forwarded email's body/headers (null for direct sends and uploads). Prefer this as the document's real contact when present.
OCR header summary (ocr_header):
- A compact summary of what OCR extracted from the document, or null while the document is still processing (or when extraction failed before analysis).
- Each field is
{value, confidence};confidenceis 0–1 or null when the extraction pipeline did not score the field. doc_number— the document's own number: invoice number (supplier_invoice, landed_cost_invoice), credit memo number (vendor_credit), or customer PO number (customer_po).total,tax_amount,currency_code— extracted money fields.doc_date— the document's own date (invoice date, credit date, or order date), distinct fromcreated_at(when the document arrived).po_number— for supplier invoices, the purchase order number referenced on the invoice (null for customer POs, where the PO number ISdoc_number).
Classification fields:
document_type— what the classifier decided the document is:invoiceorcredit_memo. Populated on supplier_invoice and vendor_credit items; always null for customer_po and landed_cost_invoice.detection_signals— array of signal keys that drove the classification (e.g.keyword:credit memo,doc_number:CM prefix,total:negative). Null when no detection ran.auto_routed— true when the document arrived in the supplier invoice pipeline but was automatically routed to the vendor credit queue by the classifier. Always false for customer_po, supplier_invoice, and landed_cost_invoice items.
When status is 'confirmed', confirmed_record is populated with { id, type, number } of the created sales order, purchase invoice, vendor credit (type: vendor_credit, number: the vendor_credit_number), or landed cost bill (type: landed_cost_invoice).
Landed cost invoice items (type: "landed_cost_invoice") expose supplier_id/supplier_name (the matched supplier, when detected) and always have customer_id, customer_name, document_type, and detection_signals as null with auto_routed false.
Request
Responses
- 200
- 401
- 403
- 429
Successful response
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.