kapi WorksDocs

Policy receipts

GET/v1/acknowledgements

The company's policy receipts in the order Kapi wrote them, each with the fields its hash covers, so anyone can check receipt_sha256 and the chain without Kapi. Employees, partners and customers; a signed act carries its signature_sha256. Requires acknowledgements:read. Names and account emails also need people:read; without it they are left out.

Authorization

bearerAuth acknowledgements:read
AuthorizationBearer <token>

A company API key, not an OAuth access token: kw_live_ in production, kw_test_ elsewhere. Send it only in the Authorization header. A key sent in a URL is revoked.

In: header

Scope: acknowledgements:read

Query Parameters

as_at?|

RFC 3339 instant with an offset, or a date read as the end of the company's day. Receipts written by then. Defaults to now.

from?|

Optional. Receipts written from this moment, inclusive; a date starts the company's day. At most 400 days before as_at. Omit it with a cursor, which keeps it.

cursor?string

Opaque next_cursor from the previous page. Send it unchanged to the same endpoint. It pins the snapshot and filters, and grants no access.

limit?integer

Rows per page, 1 to 200. Larger values are treated as 200. A page can hold fewer rows to stay within 3 MiB, so follow next_cursor until it is null.

Range1 <= value
Default200

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

# Supply the key from your server's secret manager. Do not log it.# curl reads the header from stdin, keeping the key out of its arguments.printf 'header = "Authorization: Bearer %s"\n' "$KAPI_WORKS_API_KEY" |  curl --config - --silent --show-error --fail-with-body \  'https://example.com/v1/acknowledgements'
{  "data": [    {      "deployment_id": "00000000-0000-4000-8000-000000000001",      "organization_id": "4f6b2a52-1c1e-4f7a-9d3e-2b7c8a9e0d11",      "learning_space_id": "8b2d6c3e-5f41-4a8e-9c27-1d0e3f4a5b62",      "receipt_id": "2a9c7e5f-3b1d-4f8a-9e6c-4d2b0a8f6e44",      "learner_profile_id": "1b3d5f7a-9c2e-4b6d-8f1a-3c5e7b9d2f55",      "person_name": "Tomas Reyes",      "account_email": "tomas.reyes@example.com",      "door": "partner",      "signer_company": "Northwind Logistics",      "course_id": "3e1d5c7b-9a2f-4e6d-8c1b-5a7f9e3d1c22",      "policy_title": "Partner code of conduct",      "course_release_id": "6f4e2d1c-8b7a-4c9e-9d3f-2e1a0b9c8d33",      "version": 2,      "effective_on": "2026-11-01",      "version_digest": "4b1d9e7f2a6c8e0b3d5f7a9c1e3b5d7f9a2c4e6b8d0f1a3c5e7b9d2f4a6c8e0b",      "act": "signed",      "signed_at": "2026-10-12T09:14:03.218734Z",      "sign_in_methods": "password, totp",      "assignment_id": "b6d4f2a8-9e1c-4a35-8f72-0e9d8c7b6a54",      "cycle_id": "00000000-0000-0000-0000-000000000000",      "statement_sha256": "7e9b1d3f5a7c9e2b4d6f8a0c1e3b5d7f9a2c4e6b8d0f1a3c5e7b9d2f4a6c8e0b",      "document_sha256": "0c2e4b6d8f1a3c5e7b9d2f4a6c8e0b1d3f5a7c9e2b4d6f8a0c1e3b5d7f9a2c4e",      "signature_sha256": "9d2f4a6c8e0b1d3f5a7c9e2b4d6f8a0c1e3b5d7f9a2c4e6b8d0f1a3c5e7b9d2f",      "previous_sha256": "5a7c9e2b4d6f8a0c1e3b5d7f9a2c4e6b8d0f1a3c5e7b9d2f4a6c8e0b1d3f5a7c",      "receipt_sha256": "e3b5d7f9a2c4e6b8d0f1a3c5e7b9d2f4a6c8e0b1d3f5a7c9e2b4d6f8a0c1e3b5"    }  ],  "total": 1,  "snapshot": {    "organization_id": "4f6b2a52-1c1e-4f7a-9d3e-2b7c8a9e0d11",    "deployment_id": "00000000-0000-4000-8000-000000000001",    "as_at": "2026-10-09T09:00:00Z",    "from": null,    "known_at": "2026-10-09T08:59:41Z",    "sequence": 1284,    "capture_sequence": 352,    "chain_hash": "3f9a1c7e5b2d8f4a6c0e9b1d3f5a7c9e2b4d6f8a0c1e3b5d7f9a2c4e6b8d0f1a",    "logic": {      "version": 4,      "date": "2026-10-06"    },    "history_complete_from": "2026-10-06T05:00:00Z",    "available": true  },  "next_cursor": null}

Who owes which policy version

Everyone who owed a version of one of the company's policies at `as_at`, with their state then (signed, to_do or overdue), the due date, and the receipt that settled it. Employees, partners and customers. Requires `acknowledgements:read`. Names and account emails also need `people:read`; without it they are left out.

A receipt's signed copy

The signed copy of one receipt of the company, as a PDF: the version as signed, the signature in place, and a signing record page with the document fingerprint and the receipt ID. Kapi draws it on each call and keeps no copy. Requires `acknowledgements:read` and `people:read`, because it names the person who signed. A receipt of another company, or of a person Kapi erased, answers `not_found`.