This endpoint returns metadata for the compliance documents uploaded to your tenant, so you can track what has been uploaded and whether it is ready to use as evidence.

List Documents

Returns a paginated list of compliance documents for your tenant. This feed is metadata only; it does not serve file content. There is no download URL, content field, or size field, and there is currently no Public API path to retrieve a document's bytes. Use the Cranium portal to retrieve a document.

Request:

GET /api/public/documents

Authentication:

Bearer token. See Authentication & Generating Credentials.

Required Permission

Api_Documents_Read

Query Parameters

Response Fields

Sample Response

json

{
  "data": [
    {
      "fileId": "b9c67f3a-1d8e-4a0b-bc3d-6c7d8e9f0a1b",
      "filename": "AI-Governance-Policy-v3.pdf",
      "uploadStatus": "Completed",
      "createdAt": "2026-01-10T08:00:00Z",
      "updatedAt": "2026-06-01T20:11:09Z"
    },
    {
      "fileId": "c0d78a4b-2e9f-4b1c-cd4e-7d8e9f0a1b2c",
      "filename": "Model-Risk-Assessment-Q2.docx",
      "uploadStatus": "Processing",
      "createdAt": "2026-07-02T09:15:33Z",
      "updatedAt": null
    },
    {
      "fileId": "d1e89b5c-3f0a-4c2d-de5f-8e9f0a1b2c3d",
      "filename": "third-party-audit-report.pdf",
      "uploadStatus": null,
      "createdAt": "2026-07-28T11:02:00Z",
      "updatedAt": null
    }
  ],
  "pagination": {
    "limit": 100,
    "nextCursor": "eyJ1cGRhdGVkQXQiOiIyMDI2LTA3LTI4VDExOjAyOjAwWiIsImlkIjoiZDFlODliNWMifQ==",
    "hasMore": false
  },
  "error": null,
  "meta": {
    "requestId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "timestamp": "2026-08-13T10:55:00Z"
  }
}

Record 2 is mid-ingestion. Documents are embedded asynchronously for compliance question answering, so a freshly uploaded file can appear in this feed before it is queryable. There is no link from a document to a compliance framework response on this record; the two cannot be correlated through this feed along. hasMore: false with a non-null nextCursor is the normal end-of-feed state. Store the cursor and replay it on your next poll.

Error Responses

• 400 VALIDATION_FAILED: the cursor is invalid, or cursor and updatedAfter were supplied together.
• 401 UNAUTHORIZED: the request is missing a token, or the token lacks Api_Documents_Read.
• 500 INTERNAL_ERROR: an unexpected server error.