Use this endpoint after the case shows that we need a response from you. Send one TEXT or FILE response per request.

Each requirement has a requirement_id, but that ID is only for correlation. Do not send it in the path or request body. A FILE requirement returns accepted_document_types; submitting any one of those values completes that requirement. The actual document_type in your request determines the matching requirement. A supported type that is not accepted by any current requirement is stored as voluntary evidence and does not complete another requirement.

The endpoint accepts two representations and dispatches on the Content-Type header: application/json for TEXT and multipart/form-data for FILE. Any other Content-Type is rejected.

Send a TEXT response

{ "type": "TEXT", "text": "Funds originate from invoice INV-2026-001." }

text is required, nonblank, and at most 2,560 UTF-8 bytes.

Send a FILE response

Use multipart/form-data and send the original file bytes. Do not Base64-encode the file. Send each part once; field names and enum values are case-sensitive.

Sign the request

With HMAC authentication, sign a TEXT request with the standard JSON body-signing flow. For a FILE request, choose one multipart signing mode:

• Sign the complete encoded multipart body when your client exposes the final bytes.
• Use X-OM-Content-SHA256: UNSIGNED-PAYLOAD when your client builds and sends the form internally.

See Signing multipart requests for both canonical strings, their security properties, and examples.

Idempotency

Idempotency-Key is required. A new response returns 201; an exact retry returns the original response with 200; reusing the key for different content returns 409.

A new TEXT response replaces the current TEXT evidence. You can send multiple FILE responses for the same requirement, including different values from its accepted_document_types; every file remains supplemental current evidence, while the requirement is counted once. If compliance has accepted the FILE requirement, a later FILE response supplements that accepted evidence without replacing it or reopening the requirement for review. If compliance rejects the FILE requirement, that verdict applies to every current FILE response in the review round; the next FILE response starts a new round and the rejected round is no longer returned as current evidence. The case API does not return superseded evidence as submission history.