Send us your documents. Get the numbers back.

Run a workflow over HTTP and get the result back. Start a run with a POST, then either receive a completion webhook (recommended) or poll the job by id. All requests authenticate with a Bearer API key and act as a single org.

The target workflow must contain an API In node — the dedicated API entry point. Your input JSON lands there, and any files you attach are staged onto the job.

Send the API key we sent you as a Bearer token. It is already scoped and bound to the right workflow — keep it secret and send it on every request. The scopes below are what it carries:

• workflow:execute — start runs
• workflow:read — poll job status (only needed if you poll instead of using the callback)

A key can be bound to one workflow (the run endpoint returns 403 for any other), so you can hand each integration its own scoped, revocable, rotatable credential.

Authorization: Bearer dojobase_live_xxxxxxxx

Send a document in a single HTTPS request: one multipart/form-data POST with your key and the file (up to 25 MB per file).

• file: one or more file parts (repeat -F file=@… for multiple files).
• callbackUrl: required. An httpsURL we POST to when we're done.
• idempotencyKey: optional. A retry with the same value never submits twice.

The host is ingest.dojobase.com (our ingest endpoint), not the main API host.

curl -X POST https://ingest.dojobase.com/v1/workflows/WORKFLOW_ID/submit \
  -H "Authorization: Bearer dojobase_live_xxxxxxxx" \
  -F file=@statement.pdf \
  -F callbackUrl=https://you.example/dojobase-hook \
  -F idempotencyKey=deal-4821

202 Accepted
{
  "jobId": "b3f1...",
  "status": "queued",
  "statusUrl": "https://dojobase.com/api/public/v1/jobs/b3f1...",
  "callback": "registered"
}

Optional — if you set a callbackUrlyou don't need to poll. To poll, call this until terminal is true (requires the workflow:read scope). The same shape is delivered to your callback, so you can share one handler.

curl https://dojobase.com/api/public/v1/jobs/JOB_ID \
  -H "Authorization: Bearer dojobase_live_xxxxxxxx"

200 OK
{
  "jobId": "b3f1...",
  "status": "done",              // queued | running | done | failed | rejected | cancelled
  "terminal": true,              // poll until this is true
  "error": null                  // a message when status = failed
}

If you pass callbackUrl, dojobase POSTs the terminal result to it (with retry + backoff). It is signed so you can verify it came from us — no scope needed, it's pushed to you.

POST https://you.example/dojobase-hook
x-dojobase-event: job.completed
x-dojobase-timestamp: 1730000000
x-dojobase-signature: sha256=<hex>

<same JSON body as GET /jobs/{id}>

Verify the signature: the secret is SHA-256(your API key), HMAC‑SHA256 over `${timestamp}.${rawBody}`.

import { createHash, createHmac, timingSafeEqual } from "node:crypto";

// Verify a signed dojobase callback.
//   rawBody  – the exact request body bytes (do NOT re-serialize)
//   headers  – the incoming request headers
//   apiKey   – the SAME dojobase_live_... key you sent the request with
function verify(rawBody, headers, apiKey) {
  const ts  = headers["x-dojobase-timestamp"];
  const sig = String(headers["x-dojobase-signature"] || "").replace(/^sha256=/, "");

  // Reject anything older than 5 minutes (replay protection).
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;

  // Shared secret = SHA-256(your API key) as lowercase hex. Both sides can
  // derive it; dojobase never stores your raw key.
  const secret   = createHash("sha256").update(apiKey).digest("hex");
  const expected = createHmac("sha256", secret).update(`${ts}.${rawBody}`).digest("hex");

  const a = Buffer.from(expected), b = Buffer.from(sig);
  return a.length === b.length && timingSafeEqual(a, b);
}

Errors come back as application/problem+json with a title, status, and detail.

• 401 Unauthorized: the key is missing, mistyped, or revoked. Send it as Authorization: Bearer … on every request.
• 403 Forbidden: the key isn't valid for this workflow, or it lacks the required scope.
• Callback never arrives: make sure your callbackUrl is a public https URL that returns 2xx. We retry with backoff.
• Signature won't verify: the secret is SHA-256(your API key), signed over `${timestamp}.${rawBody}`. Verify against the raw body bytes, before any JSON re-serialization.

Still stuck? Email dojobase support at support@dojobase.com.