Use this endpoint after the case shows that we need a response from you. Send one TEXT or FILE response per request.

Each requirement has a requirement_id, but that ID is only for correlation. Do not send it in the path or request body. For a FILE requirement, use the requested document_type; a different supported document type adds evidence to the case but does not complete that requirement.

The endpoint accepts two representations and dispatches on the Content-Type header: application/json for TEXT and multipart/form-data for FILE. Any other Content-Type is rejected.

Send a TEXT response

{ "type": "TEXT", "text": "Funds originate from invoice INV-2026-001." }

text is required, nonblank, and at most 2,560 UTF-8 bytes.

Send a FILE response

Use multipart/form-data and send the original file bytes. Do not Base64-encode the file. Send each part once; field names and enum values are case-sensitive.

Sign the request

With HMAC authentication, sign a TEXT request with the standard JSON body-signing flow. For a FILE request, choose one multipart signing mode:

• Sign the complete encoded multipart body when your client exposes the final bytes.
• Use X-OM-Content-SHA256: UNSIGNED-PAYLOAD when your client builds and sends the form internally.

See Signing multipart requests for both canonical strings, their security properties, and examples.

Idempotency

Idempotency-Key is required. A new response returns 201; an exact retry returns the original response with 200; reusing the key for different content returns 409.

After we commit a replacement response, it becomes the current evidence returned for that requirement. The case API does not return the previous evidence as submission history.