بوابة المطورين — FRA Digital Financial Disclosure API v1.4.0

An IR platform or company asks the FRA for credentials. One pending request per contact email. The FRA answers by webhook (`access_request.approved` / `rejected`) when `webhook_url` is given; poll /access-requests/{id}/status otherwise.

Request body application/json — AccessRequest

Field	Type	Description
company_name*	string
company_name_ar	string | null
fra_license_number	string | null
sector_code	string | null
entity_type	string | null (listed_company, nbfi, insurance, mortgage, leasing, factoring, microfinance, consumer_finance, fintech, securitization, other)
contact_name*	string
contact_email*	string (email)
contact_phone	string | null
rsa_public_key	string | null	PEM.
webhook_url	string | null (uri)
ir_system_base_url*	string (uri)
notes	string | null

Responses

Status	Description	Body
201	Request recorded. Headers: X-RateLimit-Limit, X-RateLimit-Remaining, Idempotency-Replayed	AccessRequestCreated
409	A request from this email is already pending.	ApiError
422	Validation failed.	ValidationError | ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError

For a client that lost its secret. The email must belong to a user of the client's company or to the original requester.

Request body application/json — object

Field	Type	Description
client_id*	string
contact_email*	string (email)
reason*	string

Responses

Status	Description	Body
201	Request recorded. Headers: X-RateLimit-Limit, X-RateLimit-Remaining, Idempotency-Replayed	AccessRequestCreated
404	No active client with this client_id.	ApiError
403	Email does not match the client.	ApiError
422	Validation failed.	ValidationError | ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError
409	Conflict: duplicate payload (`duplicate_submission`), idempotent request in progress (`idempotency_request_in_progress`), or a lost status race.	ApiError

The contact email must match. Once approved, `credentials.client_id` is included (the secret is delivered out of band).

Parameters

Name	In	Type	Description
id*	path	integer	Request id.
email*	query	string (email)	Contact email of the request.

Responses

Status	Description	Body
200	Status. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	AccessRequestStatus
404	Not found (or not yours).	object
422	Validation failed.	ValidationError | ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Status totals, 6-month trend and sector compliance rates. Requires an active data-sharing agreement; access is logged.

Responses

Status	Description	Body
200	Aggregates. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Submitted / accepted / rejected / pending per month, last 12 months. Requires an active data-sharing agreement; access is logged.

Responses

Status	Description	Body
200	Aggregates. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Active companies, filings and acceptance per sector this year. Requires an active data-sharing agreement; access is logged.

Responses

Status	Description	Body
200	Aggregates. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Registers a new RSA public key (PEM, ≥ 2048 bits) used to verify the client's signatures. Requires scope `client:key_rotate`. Audited.

Request body application/json — object

Field	Type	Description
rsa_public_key*	string	PEM-encoded RSA public key (min. 200 characters).

Responses

Status	Description	Body
200	Key replaced. Headers: X-RateLimit-Limit, X-RateLimit-Remaining, Idempotency-Replayed	object
422	Not an RSA key of at least 2048 bits, or validation failed.	ApiError
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError
409	Conflict: duplicate payload (`duplicate_submission`), idempotent request in progress (`idempotency_request_in_progress`), or a lost status race.	ApiError

RSA-2048 public key (PEM) to wrap the AES key of every encrypted payload. Cache it by `version`; send that version as `fra_key_version`. When called with a valid Bearer token the client's cached key version is recorded (best effort).

Responses

Status	Description	Body
200	The active key. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	PublicKey
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

For payloads prepared just before a rotation.

Parameters

Name	In	Type	Description
version*	path	integer	Key version.

Responses

Status	Description	Body
200	The key. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	PublicKey
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

A client reads only its own company unless its token holds `compliance:read_all`.

Parameters

Name	In	Type	Description
id*	path	string	Company (tenant) id.
months	query	integer	Window when from/to are absent.
from	query	string (date)	Start date.
to	query	string (date)	End date.

Responses

Status	Description	Body
200	History. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	ComplianceHistory
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Pending and overdue by default.

Parameters

Name	In	Type	Description
status	query	string (pending, filed, overdue, waived)	Only this status.
include_past	query	boolean	Include deadlines older than 30 days.

Responses

Status	Description	Body
200	Deadlines. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	DeadlineList
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Published reporting periods of a year (default: current year).

Parameters

Name	In	Type	Description
year	query	integer	Fiscal year.

Responses

Status	Description	Body
200	Periods. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	ReportingPeriodList
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Decrees and circulars the rules cite.

Responses

Status	Description	Body
200	Decrees. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Parameters

Name	In	Type	Description
id*	path	string	Decree id.

Responses

Status	Description	Body
200	Decree. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Paginated; `since` returns rules changed after a timestamp (delta sync).

Parameters

Name	In	Type	Description
since	query	string (date-time)	Only rules updated since.
category	query	string	Rule category.
severity	query	string	critical | warning | info.
per_page	query	integer	Page size.
page	query	integer	Page.

Responses

Status	Description	Body
200	Rules. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
422	Validation failed.	ValidationError | ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Runs the FRA rules (or the given subset) against a disclosure envelope and returns the flags it would raise. Stores nothing.

Request body application/json — object

Field	Type	Description
envelope*	DisclosureEnvelope
disclosure_id*	string	ULID chosen by the issuer.
envelope_version	string	Default 1.0.
company_id*	string	Issuer company identifier.
category*	string	Disclosure category.
language	string (ar, en)
submitted_at*	string (date-time)	Within ±5 min of FRA time.
period	object
start	string | null (date)
end	string | null (date)
fiscal_year	integer | null
quarter	integer | null
figures	object[]
quotes	object[]
attachments	object[]
promises	object[]
audit	object
ir_validation_hash	string	SHA-256 of canonical {figures, quotes, promises}.
signatures	object
issuer_sig	string	Signature over the canonical JSON without `signatures`.
issuer_cert_thumbprint	string
rules	string[]	Rule ids to evaluate (default: all applicable).

Responses

Status	Description	Body
200	Flags. Headers: X-RateLimit-Limit, X-RateLimit-Remaining, Idempotency-Replayed	object
422	Validation failed.	ValidationError | ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError
409	Conflict: duplicate payload (`duplicate_submission`), idempotent request in progress (`idempotency_request_in_progress`), or a lost status race.	ApiError

Parameters

Name	In	Type	Description
ruleId*	path	string	Rule id.

Responses

Status	Description	Body
200	Rule. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Canonical JSON envelope signed by the issuer certificate (`signatures.issuer_sig` over the canonical JSON without `signatures`). `submitted_at` must be within ±5 minutes of FRA time; `audit.ir_validation_hash`, when present, must match FRA's re-hash of figures/quotes/promises. FRA rules are evaluated on receipt and returned as `flags`. Not available to sandbox credentials (403 `sandbox_unsupported`).

Request body application/json — DisclosureEnvelope

Field	Type	Description
disclosure_id*	string	ULID chosen by the issuer.
envelope_version	string	Default 1.0.
company_id*	string	Issuer company identifier.
category*	string	Disclosure category.
language	string (ar, en)
submitted_at*	string (date-time)	Within ±5 min of FRA time.
period	object
start	string | null (date)
end	string | null (date)
fiscal_year	integer | null
quarter	integer | null
figures	object[]
quotes	object[]
attachments	object[]
promises	object[]
audit	object
ir_validation_hash	string	SHA-256 of canonical {figures, quotes, promises}.
signatures	object
issuer_sig	string	Signature over the canonical JSON without `signatures`.
issuer_cert_thumbprint	string

Responses

Status	Description	Body
201	Received. Headers: X-RateLimit-Limit, X-RateLimit-Remaining, Idempotency-Replayed	DisclosureReceived
422	Rejected: `error` is schema | signature | integrity | duplicate | …	ApiError
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError
409	Conflict: duplicate payload (`duplicate_submission`), idempotent request in progress (`idempotency_request_in_progress`), or a lost status race.	ApiError

Tenant-isolated: only the issuer's own disclosures.

Parameters

Name	In	Type	Description
trackingId*	path	string	ULID returned as `tracking_id`.

Responses

Status	Description	Body
200	Status. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	DisclosureStatus
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Parameters

Name	In	Type	Description
job_id*	path	string	Extraction job id.

Responses

Status	Description	Body
200	Job.	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object

Session + CSRF token.

Parameters

Name	In	Type	Description
job_id*	path	string	Extraction job id.

Responses

Status	Description	Body
200	XBRL document. Headers: Idempotency-Replayed	string
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
422	Validation failed.	ValidationError | ApiError
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError
409	Conflict: duplicate payload (`duplicate_submission`), idempotent request in progress (`idempotency_request_in_progress`), or a lost status race.	ApiError

Session + CSRF token.

Parameters

Name	In	Type	Description
job_id*	path	string	Extraction job id.

Responses

Status	Description	Body
200	Re-queued. Headers: Idempotency-Replayed	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
422	Validation failed.	ValidationError | ApiError
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError
409	Conflict: duplicate payload (`duplicate_submission`), idempotent request in progress (`idempotency_request_in_progress`), or a lost status race.	ApiError

Parameters

Name	In	Type	Description
job_id*	path	string	Extraction job id.

Responses

Status	Description	Body
200	Status.	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object

Public.

Responses

Status	Description	Body
200	Formats. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Parameters

Name	In	Type	Description
filename	query	string	File name contains.
status	query	string	Job status.
confirmation_status	query	string	approved | rejected | pending.
format	query	string	pdf, xlsx…
language	query	string	ar | en.
date_from	query	string (date)	From.
date_to	query	string (date)	To.

Responses

Status	Description	Body
200	CSV.	string
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError

Responses

Status	Description	Body
200	Options.	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError

Parameters

Name	In	Type	Description
limit	query	integer	Page size.
offset	query	integer	Offset.

Responses

Status	Description	Body
200	Jobs.	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError

Parameters

Name	In	Type	Description
filename	query	string	File name contains.
status	query	string	Job status.
confirmation_status	query	string	approved | rejected | pending.
format	query	string	pdf, xlsx…
language	query	string	ar | en.
date_from	query	string (date)	From.
date_to	query	string (date)	To.
filing_id	query	string	Filing.
sort	query	string	Sort column.
direction	query	string (asc, desc)	Direction.

Responses

Status	Description	Body
200	Results.	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError

Responses

Status	Description	Body
200	Stats.	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError

Parameters

Name	In	Type	Description
query	query	string	Prefix.
type	query	string	filename (default).

Responses

Status	Description	Body
200	Suggestions.	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError

Responses

Status	Description	Body
200	Stats.	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError

Session + CSRF token.

Parameters

Name	In	Type	Description
filing_id*	path	string	Disclosure submission id.

Request body application/json — object

Field	Type	Description
job_id*	string
confirmation_status*	string (approved, rejected)
notes	string | null
figures	object[]

Responses

Status	Description	Body
200	Recorded. Headers: Idempotency-Replayed	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
422	Validation failed.	ValidationError | ApiError
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError
409	Conflict: duplicate payload (`duplicate_submission`), idempotent request in progress (`idempotency_request_in_progress`), or a lost status race.	ApiError

Multipart upload (PDF, XLSX, XLS, CSV, DOCX; ≤ 100 MB). Session + CSRF token.

Parameters

Name	In	Type	Description
filing_id*	path	string	Disclosure submission id.

Request body multipart/form-data — object

Field	Type	Description
file*	string	Statement file.
language	string (ar, en)
confidence_threshold	number

Responses

Status	Description	Body
202	Queued. Headers: X-RateLimit-Limit, X-RateLimit-Remaining, Idempotency-Replayed	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
422	Validation failed.	ValidationError | ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError
409	Conflict: duplicate payload (`duplicate_submission`), idempotent request in progress (`idempotency_request_in_progress`), or a lost status race.	ApiError

Parameters

Name	In	Type	Description
filing_id*	path	string	Disclosure submission id.

Responses

Status	Description	Body
200	Preview.	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object

Parameters

Name	In	Type	Description
filing_id*	path	string	Disclosure submission id.

Responses

Status	Description	Body
200	Status.	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object

Parameters

Name	In	Type	Description
filing_id*	path	string	Disclosure submission id.

Responses

Status	Description	Body
200	Jobs.	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object

Internal FRA pipeline; Sanctum personal access token.

Parameters

Name	In	Type	Description
id*	path	integer	FRA document id.

Responses

Status	Description	Body
202	Queued. Headers: Idempotency-Replayed	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError
409	Conflict: duplicate payload (`duplicate_submission`), idempotent request in progress (`idempotency_request_in_progress`), or a lost status race.	ApiError

Every XBRL fact of every filing the FRA accepted — never drafts, filings under review, rejected filings or sandbox data. Filters combine with AND; list-valued filters accept comma-separated values. Responses are cached (`Cache-Control: public`) and carry an `ETag`; send `If-None-Match` to get 304. Bulk files: /facts/bulk.

Parameters

Name	In	Type	Description
concept	query	string	Concept QName(s), e.g. ifrs-full:Revenue.
company	query	string	FRA licence number(s) or LEI(s).
sector	query	string	Sector code(s).
fiscal_year	query	string	Fiscal year(s) of the filing.
period	query	string (FY, Q1, Q2, Q3, Q4)	Annual (FY) or quarter.
period_context	query	string (current, prior)	Current period or comparative.
statement	query	string	Statement code(s), e.g. SFP, PL.
filing	query	string	Filing reference number(s).
page	query	integer	Page.
per_page	query	integer	Page size.
If-None-Match	header	string	ETag of a previous response.

Responses

Status	Description	Body
200	A page of facts. Headers: X-RateLimit-Limit, X-RateLimit-Remaining, ETag, Cache-Control	FactPage
304	Not modified (If-None-Match matched).
422	Validation failed.	ValidationError | ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Gzipped CSV and xBRL-JSON (OIM 1.0) per fiscal year, regenerated daily, with row counts and SHA-256. Data dictionary: /open-data/bulk.

Responses

Status	Description	Body
200	Files. Headers: X-RateLimit-Limit, X-RateLimit-Remaining, ETag	BulkFileList
304	Not modified.
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

The STORED validation outcome of the published XBRL report of an accepted filing (in the spirit of filings.xbrl.org): overall status (valid / warnings / errors), counts per layer and every finding with rule id, severity, Arabic/English message, concept and context. Platform native checks, Arelle on the published packages and the FRA business rules. Never re-validated on request; nothing internal (reviewer notes, the uploaded file, users) is included. 404 for anything that is not an accepted public filing.

Parameters

Name	In	Type	Description
submission*	path	integer	Filing id (as in GET /xbrl/filings).

Responses

Status	Description	Body
200	Validation results. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	PublicFilingValidation
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Searches the public text of every filing the FRA accepted — company names (Arabic/English), filing metadata (reference, template, period, sector), figure labels and concepts of the published XBRL report, note and accounting-policy text blocks. Never drafts, filings under review, rejected filings or sandbox data. Arabic is normalised on both sides: diacritics and tatweel are ignored, alef forms (أ إ آ) read as ا, ى as ي, ة as ه, and Arabic-Indic digits as 0-9 — «الشركه» finds «الشركة». Put a phrase in double quotes for an exact phrase; all words must match. Results are ordered by relevance and carry an HTML snippet (`snippet_html`: escaped text, matches in `<mark>`). Give `q` or at least one filter. Cached for a short time (`Cache-Control: public`).

Parameters

Name	In	Type	Description
q	query	string	Words and "quoted phrases".
company	query	string	FRA licence number(s) or LEI(s), comma separated, or part of the company name.
sector	query	string	Sector code(s).
template	query	string	Template code(s).
fiscal_year	query	string	Fiscal year(s).
period	query	string (FY, Q1, Q2, Q3, Q4)	Annual (FY) or quarter.
accepted_from	query	string (date)	Accepted on or after.
accepted_to	query	string (date)	Accepted on or before.
kind	query	string (filing, note, figure)	Only filings, notes/policies or statement figures.
locale	query	string (ar, en)	Language of the text (bilingual rows always match).
page	query	integer	Page.
per_page	query	integer	Page size.

Responses

Status	Description	Body
200	A page of results. Headers: X-RateLimit-Limit, X-RateLimit-Remaining, Cache-Control	PublicSearchPage
422	Validation failed.	ValidationError | ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Anyone can validate an Inline XBRL / XBRL 2.1 / xBRL-JSON report or a report package against the FRA rules — the same engine as POST /xbrl/test-filing and the filing intake (rule ids, layers, Arabic/English messages) — WITHOUT filing anything and WITHOUT the file being kept: it is malware-scanned, validated in memory and deleted; only an anonymous counter (hash prefix, size, outcome, keyed IP hash) is recorded. The entity identifier is NOT checked against a registered company (anonymous); `validation.service.notes` says so. Arelle runs only when the FRA enables it for this service. Send `multipart/form-data` (`file`) or JSON (`file_name` + `content_base64`). Strict per-IP limits (per minute and per day) and a size cap (default 20 MB, 413 above it). No credentials needed. An Idempotency-Key is optional; with one, the response is kept 24 h for replay like every /api/v1 POST.

Request body multipart/form-data — object

Field	Type	Description
file*	string	The report or report package.

Responses

Status	Description	Body
200	The validation report. Headers: X-RateLimit-Limit, X-RateLimit-Remaining, Idempotency-Replayed	PublicXbrlCheckResult
413	The file is larger than the limit.	ApiError
422	Missing, empty or unsupported upload, invalid base64, or refused by the malware scan.	ApiError | ValidationError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError
409	Conflict: duplicate payload (`duplicate_submission`), idempotent request in progress (`idempotency_request_in_progress`), or a lost status race.	ApiError

Concepts with labels, data type and period type; search by `q`, restrict by namespace prefix.

Parameters

Name	In	Type	Description
namespace	query	string	Namespace prefix, e.g. ifrs-full.
q	query	string	Search text.

Responses

Status	Description	Body
200	Concepts. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Average and median of each concept across the sector's latest accepted filings.

Parameters

Name	In	Type	Description
sector_id*	query	integer	Sector id.

Responses

Status	Description	Body
200	Benchmarks. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
404	Not found (or not yours).	object
422	Validation failed.	ValidationError | ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Newest first, 20 per page. A sandbox client sees only its sandbox filings.

Parameters

Name	In	Type	Description
status	query	string	Filter by status, e.g. draft, submitted, accepted.
period	query	string	Substring of the period label, e.g. 2025.
page	query	integer	Page number.

Responses

Status	Description	Body
200	A page of filings. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	FilingList
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

For IR systems that extracted the statements themselves: items are mapped to the template by label. High-confidence, fully-matched mappings become a `draft`; otherwise `mapping_review`. Not encrypted — prefer Channel B for figures by field.

Request body application/json — FromExtractionRequest

Field	Type	Description
template_id*	integer
period_start*	string (date)
period_end*	string (date)
fiscal_year*	integer
quarter	integer | null
extracted_data*	object[]	At least one item.
item*	string	Line-item label.
value	number | null
type	string | null
section	string | null
source	string | null
ai_model	string | null

Responses

Status	Description	Body
201	Draft created with its mapping summary. Headers: X-RateLimit-Limit, X-RateLimit-Remaining, Idempotency-Replayed	ExtractionMappingResult
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
422	Validation failed.	ValidationError | ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError
409	Conflict: duplicate payload (`duplicate_submission`), idempotent request in progress (`idempotency_request_in_progress`), or a lost status race.	ApiError

The decrypted plaintext is JSON (`StructuredFilingPayload`, format `fra-structured-json-v1`): each figure names its template field by `field_key`, or by an XBRL `concept` that exactly one field carries. An unknown key, an ambiguous concept or a non-number refuses the whole filing with the list (`invalid_figures`) — nothing is guessed. Totals are re-checked and differences reported as `warnings`, never corrected. Created as a draft for the company to review and seal; with `metadata.submit: true` it goes to the FRA when every readiness gate passes (else 422 `submission_not_ready`, the draft is kept). **Sandbox**: `submit: true` runs the real data checklist and simulates the review.

Request body application/json — StructuredFilingRequest

Field	Type	Description
encrypted_key*	string	The 32-byte AES-256 key, encrypted with RSA-OAEP (SHA-1, MGF1-SHA-1 — OpenSSL OPENSSL_PKCS1_OAEP_PADDING) under the RECIPIENT's public key (FRA's for requests).
iv*	string	12-byte random GCM nonce.
ciphertext*	string	AES-256-GCM ciphertext of the plaintext (no AAD).
auth_tag*	string	16-byte GCM authentication tag.
signature*	string	RSASSA-PKCS1-v1_5 / SHA-256 signature by the SENDER over the raw ciphertext bytes (not the base64 text).
fra_key_version*	integer
metadata*	object
template_code*	string
fiscal_year*	integer
period_start	string | null (date)
period_end	string | null (date)
quarter	integer | null
period_label	string | null
checksum_sha256*	string	Hex SHA-256 of the plaintext JSON bytes.
submit	boolean | null	Submit to the FRA when every readiness gate passes.
sandbox_outcome	string (accepted, rejected, requires_amendment)	Sandbox only: simulated decision.

Responses

Status	Description	Body
201	Stored (draft) or received. Headers: X-RateLimit-Limit, X-RateLimit-Remaining, Idempotency-Replayed	StructuredFilingResult
422	Validation, unknown template, envelope failure, invalid payload, unbindable figures, or not ready.	InvalidFigures | SubmissionNotReady | ApiError | ValidationError
409	This exact payload was already submitted.	ApiError
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object
500	Processing error (`processing_error`); the message is sanitised.	ApiError
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError

The plaintext is the XBRL report: Inline XBRL (one document, or a document set inside a report package), XBRL 2.1, xBRL-JSON, or a report package (`.xbri`/`.xbr`/`.zip`, sent as its raw ZIP bytes). The platform verifies the signature, decrypts, checks `metadata.checksum_sha256` against the decrypted bytes, then reads the report through **Channel D intake**: a report that references an FRA entry point (or any package / xBRL-JSON) is validated as filed — package safety, XBRL conformance (Arelle, offline), Calculations 1.1, duplicates, FRA filing rules, data quality — and refused with 422 `xbrl_validation_failed` and the full `validation` report (`XbrlValidationReport`) on any error; nothing is filed then. Its facts are bound to the template by element, period and dimensions. The response carries `xbrl_mode: standard` and `xbrl_validation`. **Legacy mode** (`xbrl_mode: legacy_dynamic_fields`): a document without an FRA entry point — the IR platform's `fra:DynamicField_N` facts — is still read by label as before while the FRA keeps `XBRL_API_LEGACY_MODE=allow`; with `reject` it is refused (422 `legacy_format_rejected`). Validate before filing with POST /xbrl/test-filing. The filing is then stored, and the readiness gates run (checklist, attestation, internal approval). Ready → submitted to the FRA (201, `status: received`); not ready → kept as a draft the company completes in the portal (422 `submission_not_ready` with `blocking`). Optional `attachments[]` are additional encrypted files (e.g. the signed PDF) in the same envelope format, virus-scanned before storage. The exact same ciphertext can be submitted only once (409 `duplicate_submission`); use an Idempotency-Key to retry safely. **Sandbox**: the review is simulated (`sandbox: true`, `simulated_status`); `metadata.sandbox_outcome` chooses the simulated decision.

Request body application/json — XbrlFilingRequest

Field	Type	Description
encrypted_key*	string	The 32-byte AES-256 key, encrypted with RSA-OAEP (SHA-1, MGF1-SHA-1 — OpenSSL OPENSSL_PKCS1_OAEP_PADDING) under the RECIPIENT's public key (FRA's for requests).
iv*	string	12-byte random GCM nonce.
ciphertext*	string	AES-256-GCM ciphertext of the plaintext (no AAD).
auth_tag*	string	16-byte GCM authentication tag.
signature*	string	RSASSA-PKCS1-v1_5 / SHA-256 signature by the SENDER over the raw ciphertext bytes (not the base64 text).
fra_key_version*	integer	Version of the FRA public key used.
metadata*	object
template_code*	string	Template code from GET /templates.
period_start*	string (date)
period_end*	string (date)
fiscal_year*	integer
checksum_sha256*	string	Hex SHA-256 of the plaintext document.
content_type	string (xbrl, ixbrl, iXBRL, XBRL, IXBRL, xbri, xbr, zip, xbrl-json, json, xbrl-csv)	Format of the plaintext; a ZIP plaintext is always read as a report package.
file_name	string	File name of the report or package, e.g. FRA-LIC-0001-2025-12-31-annual.xbri (naming rule FRA-121).
sandbox_outcome	string (accepted, rejected, requires_amendment)	Sandbox only: simulated decision.
attachments	object[]	Optional encrypted files (same envelope, same FRA key version).
encrypted_key*	string	The 32-byte AES-256 key, encrypted with RSA-OAEP (SHA-1, MGF1-SHA-1 — OpenSSL OPENSSL_PKCS1_OAEP_PADDING) under the RECIPIENT's public key (FRA's for requests).
iv*	string	12-byte random GCM nonce.
ciphertext*	string	AES-256-GCM ciphertext of the plaintext (no AAD).
auth_tag*	string	16-byte GCM authentication tag.
signature*	string	RSASSA-PKCS1-v1_5 / SHA-256 signature by the SENDER over the raw ciphertext bytes (not the base64 text).
filename	string

Responses

Status	Description	Body
201	Received and submitted to the FRA (sandbox: simulated). Headers: X-RateLimit-Limit, X-RateLimit-Remaining, Idempotency-Replayed	FilingReceived
422	Validation failed, unknown template, decryption/signature/checksum failure, key version not found, XBRL report refused (xbrl_validation_failed, template_mismatch, legacy_format_rejected), or not ready (stored as draft).	SubmissionNotReady | XbrlValidationFailed | ApiError | ValidationError
409	This exact payload was already submitted.	ApiError
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object
500	Processing error (`processing_error`); the message is sanitised.	ApiError
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError

The figures read from the company's own filing, each with its source position (page, row, bounding box) and — once data reconciliation has run — its verdict (read correctly / corrected with evidence / suspect / unreadable) and the evidence it rests on (DI-011, DI-031). Text-only items are left out.

Parameters

Name	In	Type	Description
reference*	path	string	Filing reference number, e.g. FRA-2025-E-00042.

Responses

Status	Description	Body
200	The filing's figures. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	FilingFigures
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Workflow status, validation result, reviewer assignment and AI pre-review summary. Poll with back-off (e.g. 5 s → 60 s); webhooks (`filing.status_changed`) avoid polling. For a sandbox filing `status` is the simulated status.

Parameters

Name	In	Type	Description
reference*	path	string	Filing reference number, e.g. FRA-2025-E-00042.

Responses

Status	Description	Body
200	Status. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	FilingStatus
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Only for accepted filings of the authenticated company.

Parameters

Name	In	Type	Description
reference*	path	string	Filing reference number, e.g. FRA-2025-E-00042.

Responses

Status	Description	Body
200	XBRL 2.1 instance. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	string
422	The filing is not accepted yet.	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Same envelope as the filing. The decrypted bytes must match `checksum_sha256`, pass the virus scan and the content-type sniffing. Refused for finalized (accepted/rejected) filings.

Parameters

Name	In	Type	Description
reference*	path	string	Filing reference number, e.g. FRA-2025-E-00042.

Request body application/json — AttachmentRequest

Field	Type	Description
encrypted_key*	string	The 32-byte AES-256 key, encrypted with RSA-OAEP (SHA-1, MGF1-SHA-1 — OpenSSL OPENSSL_PKCS1_OAEP_PADDING) under the RECIPIENT's public key (FRA's for requests).
iv*	string	12-byte random GCM nonce.
ciphertext*	string	AES-256-GCM ciphertext of the plaintext (no AAD).
auth_tag*	string	16-byte GCM authentication tag.
signature*	string	RSASSA-PKCS1-v1_5 / SHA-256 signature by the SENDER over the raw ciphertext bytes (not the base64 text).
fra_key_version*	integer
filename*	string	Letters, digits, spaces, . _ - only.
content_type*	string
checksum_sha256*	string	Hex SHA-256 of the file.

Responses

Status	Description	Body
201	Stored. Headers: X-RateLimit-Limit, X-RateLimit-Remaining, Idempotency-Replayed	AttachmentReceived
422	Validation, decryption, checksum, scan, or finalized filing.	ApiError | ValidationError
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object
500	Processing error (`processing_error`); the message is sanitised.	ApiError
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError
409	Conflict: duplicate payload (`duplicate_submission`), idempotent request in progress (`idempotency_request_in_progress`), or a lost status race.	ApiError

Database reachability only; no internal state.

Responses

Status	Description	Body
200	Healthy. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	Health
503	Degraded.	Health
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

For load balancers and monitoring; not throttled.

Responses

Status	Description	Body
200	Status.	object
503	Not healthy / not ready.

For load balancers and monitoring; not throttled.

Responses

Status	Description	Body
200	Status.	object
503	Not healthy / not ready.

FRA administrators only (portal session).

Responses

Status	Description	Body
200	Metrics.	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError

For load balancers and monitoring; not throttled.

Responses

Status	Description	Body
200	Status.	object
503	Not healthy / not ready.

OAuth 2.0 client-credentials grant. Send `client_id` and `client_secret` (JSON or form). `scope` (space-separated) narrows the token to a subset of the client's scopes; unknown scopes are dropped. Excluded from Idempotency-Key handling: its response is a credential and is never stored.

Request body application/json — TokenRequest

Field	Type	Description
grant_type*	string (client_credentials)
client_id*	string
client_secret*	string
scope	string	Space-separated subset of the client's scopes (optional).

Responses

Status	Description	Body
200	Token issued. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	TokenResponse
401	Unknown, inactive or expired client, or wrong secret.	OAuthError
422	Validation failed.	ValidationError | ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Responses

Status	Description	Body
200	OpenAPI 3.1 document. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Responses

Status	Description	Body
200	OpenAPI 3.1 document.	string
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Companies, filings and acceptance rate per sector (this year). Cached for one hour. Sandbox and test data are never counted.

Responses

Status	Description	Body
200	Statistics. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	StatsSector[]
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Filings and acceptances per month. Cached for one hour. Sandbox and test data are never counted.

Parameters

Name	In	Type	Description
months	query	integer	Number of months.

Responses

Status	Description	Body
200	Statistics. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	StatsMonth[]
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Companies, filings this year, acceptance rate. Cached for one hour. Sandbox and test data are never counted.

Responses

Status	Description	Body
200	Statistics. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	StatsOverview
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Public compliance ranking. Cached for one hour. Sandbox and test data are never counted.

Responses

Status	Description	Body
200	Statistics. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	StatsCompany[]
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Template deadlines in the coming weeks with filing counts so far. Cached for one hour. Sandbox and test data are never counted.

Responses

Status	Description	Body
200	Statistics. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object[]
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Responses

Status	Description	Body
200	Taxonomies. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Parameters

Name	In	Type	Description
sectorCode*	path	string	Sector code, e.g. INS, LEAS.

Responses

Status	Description	Body
200	Taxonomies. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Parameters

Name	In	Type	Description
taxonomy*	path	integer	Taxonomy id.

Responses

Status	Description	Body
200	Taxonomy. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Without fields; use /templates/{template} or /templates/sync for fields.

Parameters

Name	In	Type	Description
sector_code	query	string	Templates applicable to this sector.
frequency	query	string	Filing frequency, e.g. annual, quarterly.

Responses

Status	Description	Body
200	Templates. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

The label aliases the platform uses to map extracted line items to fields.

Responses

Status	Description	Body
200	Label map. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

The sector-specific template, falling back to the general one.

Parameters

Name	In	Type	Description
sectorCode*	path	string	Sector code, e.g. INS, LEAS.

Responses

Status	Description	Body
200	Template with fields. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

For IR systems that mirror the templates. `since` returns only templates updated after that time.

Parameters

Name	In	Type	Description
since	query	string (date-time)	Only templates updated since.

Responses

Status	Description	Body
200	Templates with fields. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	TemplateSync
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

404 when inactive.

Parameters

Name	In	Type	Description
template*	path	integer	Template id (from GET /templates).

Responses

Status	Description	Body
200	Template. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

The template JSON in the hybrid envelope, encrypted under the CLIENT's RSA public key and signed by the FRA — decrypt with your private key, verify with the FRA public key.

Parameters

Name	In	Type	Description
template*	path	integer	Template id (from GET /templates).

Responses

Status	Description	Body
200	Encrypted template. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
422	Validation failed.	ValidationError | ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Per field: labels, type, section, label aliases, XBRL concept, required.

Parameters

Name	In	Type	Description
template*	path	integer	Template id (from GET /templates).

Responses

Status	Description	Body
200	Hints keyed by field_key. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Ordered as on the form.

Parameters

Name	In	Type	Description
template*	path	integer	Template id (from GET /templates).

Responses

Status	Description	Body
200	Fields. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

The JSON form schema used by the portal wizard.

Parameters

Name	In	Type	Description
template*	path	integer	Template id (from GET /templates).

Responses

Status	Description	Body
200	Form schema. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Cross-check formulas applied by the FRA, with tolerance and severity.

Parameters

Name	In	Type	Description
template*	path	integer	Template id (from GET /templates).

Responses

Status	Description	Body
200	Validators. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	TemplateValidators
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
404	Not found (or not yours).	object
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Runs the full Channel D validation of an XBRL report — exactly what POST /filings/submit would apply — and returns the machine-readable validation report (`XbrlValidationReport`): every finding with its numbered rule id (rules file: `GET /xbrl/filer-manual/rules.json`), its layer (package, xbrl, calculation, duplicates, filing, data_quality, business), severity and Arabic/English message. **Nothing is filed** and no filing is created; the run is kept for audit. Send the report as `multipart/form-data` (`file`) or as JSON (`file_name` + `content_base64`). Report packages (`.xbri`, `.xbr`, `.zip`) are accepted, including multi-document Inline XBRL document sets. `template_code` is only needed when the report does not reference an FRA template entry point; `fiscal_year` checks rule FRA-109. Works with sandbox and production credentials (the company of the credential is the one whose identifier is checked). The file is malware-scanned first. HTTP 200 whenever the report could be validated — `validation.valid` says whether it would be accepted.

Request body multipart/form-data — object

Field	Type	Description
file*	string	The report or report package.
template_code	string
fiscal_year	integer

Responses

Status	Description	Body
200	The validation report (valid or not). Headers: X-RateLimit-Limit, X-RateLimit-Remaining, Idempotency-Replayed	XbrlTestFilingResult
422	Missing or unreadable upload, unknown template_code, or the file failed the malware scan.	ApiError | ValidationError
401	Missing, invalid or expired token (`missing_token`, `invalid_token`).	ApiError
403	Missing scope (`insufficient_scope`), IP not allowed (`ip_not_allowed`), client certificate missing or not accepted (`client_certificate_required`, `client_certificate_mismatch`, `client_certificate_expired`, `client_certificate_revoked`, `client_certificate_not_registered`, `client_certificate_invalid`), client not bound to a company, or sandbox restriction.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError
409	Conflict: duplicate payload (`duplicate_submission`), idempotent request in progress (`idempotency_request_in_progress`), or a lost status race.	ApiError

Only authorisations in force today (active, inside valid_from…valid_to, agent approved by the FRA). Never lists any other company. Agent clients only.

Parameters

Name	In	Type	Description
X-FRA-Agent-User-Token*	header	string	Personal API token of the agent staff member (issued in the agent workspace; expires).

Responses

Status	Description	Body
200	The authorising companies. Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
401	Missing / invalid bearer token, or missing / expired agent user token.	ApiError
403	Not an agent client (`not_an_agent_client`), agent not active, or scope missing.	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

Issues a new client secret with a new expiry (agents.api.client_secret_ttl_days) and revokes every access token issued under the previous one. Requires the personal token of an agent admin. Audited. The response carries a credential and is never stored by the idempotency layer: a retry with the same key rotates again.

Parameters

Name	In	Type	Description
X-FRA-Agent-User-Token*	header	string	Personal API token of the agent staff member (issued in the agent workspace; expires).

Responses

Status	Description	Body
200	New secret (shown once). Headers: X-RateLimit-Limit, X-RateLimit-Remaining	object
400	Malformed request: missing (`idempotency_key_required`) or invalid (`invalid_idempotency_key`) Idempotency-Key.	ApiError
401	Missing / invalid bearer token or agent user token.	ApiError
403	Not an agent client, or the user token is not an agent admin's (`agent_admin_required`).	ApiError
429	Rate limit exceeded — for authenticated calls the API client's own per-minute or per-day quota (`rate_limit_exceeded`, `retry_after` seconds). Headers: Retry-After, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining	object

One JSON-RPC 2.0 message per request (no batches). `initialize` returns the negotiated `protocolVersion` (2025-06-18, 2025-03-26 or 2024-11-05), the server capabilities and an `Mcp-Session-Id` header; send it back on later requests (an unknown session → 404 / -32004). A notification (no `id`) is accepted with 202 and no body. Responses are `application/json` (no SSE stream; GET on this URL → 405). Tool results carry `content` (text) and `structuredContent`; a tool that cannot answer (e.g. filing not found) returns `isError: true`. Every call is audited. Limits: per caller 60 messages and 30 tool calls per minute (429 / -32003), plus the API client quota.

Parameters

Name	In	Type	Description
Mcp-Session-Id	header	string	Session id returned by initialize.
MCP-Protocol-Version	header	string	Negotiated protocol version (an unsupported value → 400 / -32005).

Request body application/json — object

Field	Type	Description
jsonrpc*	string (2.0)
id	string | integer
method*	string (initialize, ping, tools/list, tools/call, resources/list, resources/read, notifications/initialized, notifications/cancelled)
params	object

Responses

Status	Description	Body
200	JSON-RPC response (result or error). Headers: Mcp-Session-Id, X-RateLimit-Limit, X-RateLimit-Remaining, Idempotency-Replayed	object | object
202	Notification accepted (no body).
400	Parse error, invalid request, batch, unsupported protocol version, or a bad Idempotency-Key.	object
401	Missing, invalid or expired token (-32001).	object
403	Missing scope mcp:read, not FRA staff, IP / client certificate refused (-32002).	object
404	Session not found or expired (-32004), or the server is disabled.	object
409	Conflict: duplicate payload (`duplicate_submission`), idempotent request in progress (`idempotency_request_in_progress`), or a lost status race.	ApiError
413	Request body too large.	object
429	Rate limit or API client quota exceeded (-32003); Retry-After.	object

Error model of the platform's own errors.

Field	Type	Description
error*	string	Machine-readable error code, e.g. unknown_template, decryption_failed, checksum_mismatch, key_version_mismatch, submission_not_ready, invalid_figures, duplicate_submission, idempotency_key_reused, insufficient_scope, sandbox_unsupported.
message	string	Human-readable explanation.
code	string	Sub-code, e.g. signature_invalid / decryption_error, missing_token, invalid_token.

Request validation failure (HTTP 422).

Field	Type	Description
message*	string
errors*	object	Field → messages.

Field	Type	Description
error*	string (invalid_client)
error_description	string

Field	Type	Description
grant_type*	string (client_credentials)
client_id*	string
client_secret*	string
scope	string	Space-separated subset of the client's scopes (optional).

Field	Type	Description
access_token*	string	Opaque token (80 characters).
token_type*	string (Bearer)
expires_in*	integer	Seconds (3600).
scope*	string	Granted scopes, space-separated.

Field	Type	Description
public_key*	string	PEM, RSA-2048.
version*	integer	Send as fra_key_version.
algorithm	string (RSA-2048)
purpose	string (xbrl_transport)
expires_at	string | null (date-time)
fingerprint	string	SHA256:<base64> of the DER key.
is_active	boolean

Hybrid encryption envelope (XBRLEncryptionService). Steps for a request: (1) random AES-256 key + 12-byte IV; (2) AES-256-GCM encrypt the plaintext → ciphertext + 16-byte tag; (3) RSA-OAEP-encrypt the AES key with the FRA public key; (4) sign the ciphertext bytes with your RSA private key (PKCS#1 v1.5, SHA-256); (5) base64 every field. The FRA verifies the signature first, then decrypts, then compares SHA-256(plaintext) with the checksum you send.

Field	Type	Description
encrypted_key*	string	The 32-byte AES-256 key, encrypted with RSA-OAEP (SHA-1, MGF1-SHA-1 — OpenSSL OPENSSL_PKCS1_OAEP_PADDING) under the RECIPIENT's public key (FRA's for requests).
iv*	string	12-byte random GCM nonce.
ciphertext*	string	AES-256-GCM ciphertext of the plaintext (no AAD).
auth_tag*	string	16-byte GCM authentication tag.
signature*	string	RSASSA-PKCS1-v1_5 / SHA-256 signature by the SENDER over the raw ciphertext bytes (not the base64 text).

Field	Type	Description
encrypted_key*	string	The 32-byte AES-256 key, encrypted with RSA-OAEP (SHA-1, MGF1-SHA-1 — OpenSSL OPENSSL_PKCS1_OAEP_PADDING) under the RECIPIENT's public key (FRA's for requests).
iv*	string	12-byte random GCM nonce.
ciphertext*	string	AES-256-GCM ciphertext of the plaintext (no AAD).
auth_tag*	string	16-byte GCM authentication tag.
signature*	string	RSASSA-PKCS1-v1_5 / SHA-256 signature by the SENDER over the raw ciphertext bytes (not the base64 text).
fra_key_version*	integer	Version of the FRA public key used.
metadata*	object
template_code*	string	Template code from GET /templates.
period_start*	string (date)
period_end*	string (date)
fiscal_year*	integer
checksum_sha256*	string	Hex SHA-256 of the plaintext document.
content_type	string (xbrl, ixbrl, iXBRL, XBRL, IXBRL, xbri, xbr, zip, xbrl-json, json, xbrl-csv)	Format of the plaintext; a ZIP plaintext is always read as a report package.
file_name	string	File name of the report or package, e.g. FRA-LIC-0001-2025-12-31-annual.xbri (naming rule FRA-121).
sandbox_outcome	string (accepted, rejected, requires_amendment)	Sandbox only: simulated decision.
attachments	object[]	Optional encrypted files (same envelope, same FRA key version).
encrypted_key*	string	The 32-byte AES-256 key, encrypted with RSA-OAEP (SHA-1, MGF1-SHA-1 — OpenSSL OPENSSL_PKCS1_OAEP_PADDING) under the RECIPIENT's public key (FRA's for requests).
iv*	string	12-byte random GCM nonce.
ciphertext*	string	AES-256-GCM ciphertext of the plaintext (no AAD).
auth_tag*	string	16-byte GCM authentication tag.
signature*	string	RSASSA-PKCS1-v1_5 / SHA-256 signature by the SENDER over the raw ciphertext bytes (not the base64 text).
filename	string

Field	Type	Description
encrypted_key*	string	The 32-byte AES-256 key, encrypted with RSA-OAEP (SHA-1, MGF1-SHA-1 — OpenSSL OPENSSL_PKCS1_OAEP_PADDING) under the RECIPIENT's public key (FRA's for requests).
iv*	string	12-byte random GCM nonce.
ciphertext*	string	AES-256-GCM ciphertext of the plaintext (no AAD).
auth_tag*	string	16-byte GCM authentication tag.
signature*	string	RSASSA-PKCS1-v1_5 / SHA-256 signature by the SENDER over the raw ciphertext bytes (not the base64 text).
fra_key_version*	integer
metadata*	object
template_code*	string
fiscal_year*	integer
period_start	string | null (date)
period_end	string | null (date)
quarter	integer | null
period_label	string | null
checksum_sha256*	string	Hex SHA-256 of the plaintext JSON bytes.
submit	boolean | null	Submit to the FRA when every readiness gate passes.
sandbox_outcome	string (accepted, rejected, requires_amendment)	Sandbox only: simulated decision.

The PLAINTEXT of a Channel B filing, before encryption. Its exact bytes are what checksum_sha256 covers.

Field	Type	Description
format*	string = fra-structured-json-v1
figures*	object[]
field_key	string	Template field key (preferred).
concept	string	XBRL concept QName carried by exactly one field (alternative to field_key).
current	number | string | null	Current-period value; strings like "1,250" or "(5)" are read as numbers.
prior	number | string | null	Comparative value.
note	string	Note reference (≤ 20 chars).
text	object	Text fields by field_key (≤ 5000 chars each).

Field	Type	Description
filing_reference*	string
submission_id*	integer
status*	string (received)
decryption_status	string
signature_valid	boolean
validation_status	string
estimated_review_time	string
rejected_attachments	object[]
index	integer
error	string
message	string
timestamp	string (date-time)
sandbox	boolean
simulated_status	string
simulated_gates	string[]
xbrl_mode	string (standard, legacy_dynamic_fields)	How the report was read.
xbrl_validation	object	Standard mode: the stored validation run of the report (warnings only — a report with errors is refused).
run_id	integer
status	string (passed, warnings)
rules_version	string
errors	integer
warnings	integer
findings	XbrlValidationFinding[]
rule_id*	string	Rule id from the rules file (PKG-0xx, XBRL-0xx/1xx, CALC-0xx, DUP-0xx, FRA-1xx, DQ-0xx, FRA-00x, FRA_INS_SOLVENCY).
layer*	string (package, xbrl, calculation, duplicates, filing, data_quality, business)
severity*	string (error, warning, info)
message*	object
concept	string	Element QName (platform prefixes: ifrs-full, fra, fra-ins…).
context	string
period	string
unit	string
value	string
field	string	Template field key.
path	string	Path inside the package.
arelle_code	string	Arelle message code (layer xbrl).
document	string	Document of an Inline XBRL document set.
source	string	arelle when the finding comes from Arelle.
xbrl_mode_notice	string	Legacy mode notice.

Field	Type	Description
rule_id*	string	Rule id from the rules file (PKG-0xx, XBRL-0xx/1xx, CALC-0xx, DUP-0xx, FRA-1xx, DQ-0xx, FRA-00x, FRA_INS_SOLVENCY).
layer*	string (package, xbrl, calculation, duplicates, filing, data_quality, business)
severity*	string (error, warning, info)
message*	object
ar*	string
en*	string
concept	string	Element QName (platform prefixes: ifrs-full, fra, fra-ins…).
context	string
period	string
unit	string
value	string
field	string	Template field key.
path	string	Path inside the package.
arelle_code	string	Arelle message code (layer xbrl).
document	string	Document of an Inline XBRL document set.
source	string	arelle when the finding comes from Arelle.

Layered validation report of an XBRL report (Channel D).

Field	Type	Description
report_version*	string = 1.0
rules_version*	string	Version of the rules file the report was checked against.
valid*	boolean	No error: the report would be accepted.
status*	string (passed, warnings, failed)
summary*	object
errors*	integer
warnings*	integer
info*	integer
layers*	object[]
layer*	string
title	object
ar	string
en	string
status*	string (passed, warnings, failed, skipped, not_configured, disabled)
errors*	integer
warnings*	integer
detail	object	Layer details (Arelle mode and version, checks counted…).
findings*	XbrlValidationFinding[]
rule_id*	string	Rule id from the rules file (PKG-0xx, XBRL-0xx/1xx, CALC-0xx, DUP-0xx, FRA-1xx, DQ-0xx, FRA-00x, FRA_INS_SOLVENCY).
layer*	string (package, xbrl, calculation, duplicates, filing, data_quality, business)
severity*	string (error, warning, info)
message*	object
ar*	string
en*	string
concept	string	Element QName (platform prefixes: ifrs-full, fra, fra-ins…).
context	string
period	string
unit	string
value	string
field	string	Template field key.
path	string	Path inside the package.
arelle_code	string	Arelle message code (layer xbrl).
document	string	Document of an Inline XBRL document set.
source	string	arelle when the finding comes from Arelle.
report	object
file_name	string
file_sha256	string
format	string (ixbrl, ixbrl-set, xbrl-xml, xbrl-json, xbrl-csv, unknown)
documents	string[]
schema_refs	string[]
entry_point	string | null
taxonomy_version	string | null
entity	object | null
scheme	string
id	string
facts	integer
mapping	object | null
template_code	string
framework	string
fiscal_year	integer
figures	integer	Template rows filled.
unmapped	integer
dimensional_not_transferred	integer
generated_at	string (date-time)

Field	Type	Description
file_name*	string	e.g. FRA-LIC-0001-2025-12-31-annual.xbri
content_base64*	string	The report or report package bytes.
template_code	string	Only when the report references no FRA template entry point.
fiscal_year	integer

Field	Type	Description
environment*	string (sandbox, production)
filed*	boolean =
run_id	integer	Stored validation run (audit).
validation*	XbrlValidationReport	Layered validation report of an XBRL report (Channel D).
report_version*	string = 1.0
rules_version*	string	Version of the rules file the report was checked against.
valid*	boolean	No error: the report would be accepted.
status*	string (passed, warnings, failed)
summary*	object
errors*	integer
warnings*	integer
info*	integer
layers*	object[]
layer*	string
title	object
status*	string (passed, warnings, failed, skipped, not_configured, disabled)
errors*	integer
warnings*	integer
detail	object	Layer details (Arelle mode and version, checks counted…).
findings*	XbrlValidationFinding[]
rule_id*	string	Rule id from the rules file (PKG-0xx, XBRL-0xx/1xx, CALC-0xx, DUP-0xx, FRA-1xx, DQ-0xx, FRA-00x, FRA_INS_SOLVENCY).
layer*	string (package, xbrl, calculation, duplicates, filing, data_quality, business)
severity*	string (error, warning, info)
message*	object
concept	string	Element QName (platform prefixes: ifrs-full, fra, fra-ins…).
context	string
period	string
unit	string
value	string
field	string	Template field key.
path	string	Path inside the package.
arelle_code	string	Arelle message code (layer xbrl).
document	string	Document of an Inline XBRL document set.
source	string	arelle when the finding comes from Arelle.
report	object
file_name	string
file_sha256	string
format	string (ixbrl, ixbrl-set, xbrl-xml, xbrl-json, xbrl-csv, unknown)
documents	string[]
schema_refs	string[]
entry_point	string | null
taxonomy_version	string | null
entity	object | null
facts	integer
mapping	object | null
template_code	string
framework	string
fiscal_year	integer
figures	integer	Template rows filled.
unmapped	integer
dimensional_not_transferred	integer
generated_at	string (date-time)