> ## Documentation Index
> Fetch the complete documentation index at: https://developers.resistant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart API

This quickstart walks you through the **minimum** steps to process a document using the Resistant Documents API:

1. Create a submission
2. Upload the file bytes to the returned `upload_url`
3. Poll `/fraud` until a terminal status is returned

<Note>
  If you need terminology (e.g., `submission_id`, stage/cell, status meanings), see [Concepts](/getting-started/concepts).
</Note>

<CardGroup>
  <Card title="Getting an access token" href="/getting-started/getting-access-token">
    Token URLs and OAuth2 client credentials.
  </Card>

  <Card title="Domains to allowlist" href="/getting-started/domains-to-allowlist">
    Only needed if you're behind a firewall/proxy.
  </Card>

  <Card title="Polling for results" href="/receiving-results/overview">
    Exponential backoff guidance and timeouts.
  </Card>
</CardGroup>

***

## Prerequisites

* You have a **Client ID** and **Client Secret**
* You have a sample file ready (PDF or image)
* If you are behind a firewall/proxy: confirm [Domains to allowlist](/getting-started/domains-to-allowlist)

<Tip>
  This page uses the default EU endpoint (`api.documents.resistant.ai`). If your tenant is in another cell (e.g., `us-1`, `ca-1`, `ap-2`, `ap-3`), use the corresponding base URL described in [Concepts](/getting-started/concepts).
</Tip>

***

<Steps>
  <Step title="Get an access token">
    ```bash theme={null}
    TOKEN_URL="<your_token_url>"
    CLIENT_ID="<your_client_id>"
    CLIENT_SECRET="<your_client_secret>"

    BASIC_AUTH=$(echo -n "$CLIENT_ID:$CLIENT_SECRET" | base64)

    curl --request POST \
      --url "$TOKEN_URL" \
      --header "accept: application/json" \
      --header "authorization: Basic $BASIC_AUTH" \
      --header "content-type: application/x-www-form-urlencoded" \
      --data "grant_type=client_credentials&scope=submissions.read submissions.write"
    ```

    <Tip>
      Token URLs differ by stage/cell. Use the table on [Getting an access token](/getting-started/getting-access-token).
    </Tip>
  </Step>

  <Step title="Create a submission">
    ```http theme={null}
    POST https://api.documents.resistant.ai/v2/submission
    Authorization: Bearer <access_token>
    Content-Type: application/json

    {
      "query_id": "internal-doc-12345",
      "pipeline_configuration": "FRAUD_ONLY",
      "enable_decision": false,
      "enable_submission_characteristics": false
    }
    ```

    **Response (example)**

    ```json theme={null}
    {
      "submission_id": "sub_abc123xyz",
      "upload_url": "https://...presigned-url..."
    }
    ```

    <Warning>
      `query_id` must not contain PII. Use an internal opaque ID (e.g., UUID).
    </Warning>
  </Step>

  <Step title="Upload the file bytes to upload_url">
    ```bash theme={null}
    UPLOAD_URL="<upload_url_from_create_submission>"
    FILE_PATH="/path/to/document.pdf"

    curl --request PUT \
      --url "$UPLOAD_URL" \
      --header "content-type: application/octet-stream" \
      --data-binary @"$FILE_PATH"
    ```

    <Tip>
      Upload failures are commonly caused by missing allowlist rules or incorrect `Content-Type`. See [Domains to allowlist](/getting-started/domains-to-allowlist).
    </Tip>
  </Step>

  <Step title="Poll for the fraud result">
    ```http theme={null}
    GET https://api.documents.resistant.ai/v2/submission/{submission_id}/fraud
    Authorization: Bearer <access_token>
    ```

    **Polling behavior**

    * Use exponential backoff (cap interval at **45 seconds**)
    * Stop polling after **15 minutes** (hard analysis timeout)

    **What responses mean**

    * `200` → processing finished (success or terminal error included in payload)
    * `404` → result not ready yet (retry with backoff)

    <Tip>
      See [Polling for results](/receiving-results/polling) for a recommended backoff strategy and edge cases.
    </Tip>
  </Step>

  <Step title="Store results">
    At minimum, store:

    * `submission_id`
    * `query_id` (if used)
    * `analysis_time`, `sha256`, `score`
    * the full JSON response body (store as a blob / document)

    Optional:

    * View the result in the **Web UI** (deep link by `submission_id`)
    * Render results in the **Offline iFrame viewer** (if enabled)
  </Step>
</Steps>

***

## Next steps

* Enable additional outputs: **quality**, **classification**, **decision**
* Switch from polling to **Amazon SQS** or **Webhooks** (optional add-ons)
* Enable **Submission characteristics** (optional)
* Enable **Payload encryption** (optional)