OVOK DOCS
Get startedOvokSignalsSDKsGuidesAPI referenceDeveloper resources
Document

Search documents

  • Sandbox: available
  • Staging: available
  • Production: unknown
GET
/document

Lists the documents you can read, newest first by default. Use it to build a file list.

Auth: bearer token. The search runs with your token, so Medplum returns only DocumentReferences you can read.

Behaviour

  • _count sets the page size (default 100), _offset the number of documents to skip (default 0), and _sort the order (default -_lastUpdated).
  • total is an estimate from Medplum, not an exact count. Use it for a page counter, not for logic that needs the exact number.
  • Each entry has id, meta.lastUpdated, author, fileName, contentType, and publicToken when the document is public. Entries never include uploadOptions.

Example

curl -G 'https://api.sandbox.ovok.com/document' \  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \  -d '_count=20' \  -d '_offset=0'

Authorization

bearer
headerAuthorizationBearer <JWT>

Query Parameters

_count?string
Default"100"
_offset?string
Default"0"
_sort?string
Default"-_lastUpdated"

Response Body

A page of documents and the estimated total.

application/json
  1. response
total*number

Total number of documents in the system.

resources*array<>
Example Request
curl -X GET 'https://api.sandbox.ovok.com/document'
Example Response
{  "total": 0,  "resources": [    {      "id": "string",      "meta": {        "lastUpdated": "string"      },      "author": {        "reference": "string",        "display": "string"      },      "fileName": "string",      "contentType": "string",      "uploadOptions": {        "url": "string",        "fields": {          "property1": "string",          "property2": "string"        }      },      "publicToken": "string"    }  ]}

Request consent signature POST

Requests an e-signature for a FHIR `Consent`: Ovok renders the consent text as a PDF, uploads it to the e-signature service (Documenso) with the verifier as the signer, and returns the document metadata. **Auth:** bearer token. Every FHIR read runs with your token, so you must be able to read the Consent and the resources it points to. ## Behaviour - The Consent must have: - `patient` referencing a `Patient`; - a `provision.data` reference to a `Composition` that holds the consent text; - a `verification` entry whose `verifiedWith` references a `Patient` or `RelatedPerson`, with `verified` not `true`. - The text comes from the Composition section coded `main-content`. It is a Handlebars template filled with `patient`, `signer` and `organization` (the display names of the patient, the verifier and the project). - The signer's email is the first `email` entry in the verifier's `telecom`. - The document language comes from the Composition's CMS language coding when it is one of `en`, `de`, `fr`, `es`, `it`, `pl`; otherwise `de`. - On success an identifier with system `https://app.documenso.com` and the new document ID is added to the Consent. Each call creates a new signature document and adds another identifier. - The response holds `numberOfPages`, `title`, `author`, `subject`, `documentId` and `email` (the signer's address). ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/consent/signature/c3499c27-2973-0a7f-807e-fb8676a92dcb' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' ```

Create document upload credentials POST

Creates a document and returns a signed form that you use to upload its file straight to storage. Use it for every new file: Ovok never receives the file bytes itself. **Auth:** bearer token. The document is created with your token, so you need create access to Binary and DocumentReference. **Scope:** the caller's project (from the token). ## Behaviour - Creates an empty Binary and a DocumentReference with `status: current`, the given `fileName` as title and `contentType`, and you as `author`. - `contentType` must be one of the allowed types: `image/jpeg`, `image/jpg`, `image/png`, `image/gif`, `image/webp`, `application/pdf`, `application/json`, `application/xml`, `text/plain`, `text/csv`, `video/mp4`, `video/webm`, `audio/mpeg`, `audio/wav`. - With `isPublic: "true"`, the document also gets a public token (`publicToken`) that anyone can use with `GET /document/public/{token}`. - `uploadOptions` holds a URL and form fields. Send a `multipart/form-data` POST to `uploadOptions.url` with every entry of `uploadOptions.fields` as a form field, then the file as the field `file`. The form expires 10 minutes after it is issued and accepts files up to 5 GB. - The document exists as soon as this call returns, even if you never upload the file. - This route is rate limited: 20 requests a minute for admins, 10 a minute for other users. ## Example ```bash curl -X POST 'https://api.sandbox.ovok.com/document' \ -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk' \ -H 'Content-Type: application/json' \ -d '{ "fileName": "cat.png", "contentType": "image/png", "isPublic": "false" }' ``` ```json { "id": "87ea5dfc-8b8e-384d-8489-79496e706390", "meta": { "lastUpdated": "2026-01-01T12:00:00.000Z" }, "author": { "reference": "Practitioner/...", "display": "Max Mustermann" }, "fileName": "cat.png", "contentType": "image/png", "uploadOptions": { "url": "https://...", "fields": { "key": "...", "Policy": "...", "X-Amz-Signature": "...", ... } } } ``` Then upload the file with the returned form: ```bash curl -X POST '<uploadOptions.url>' \ -F 'key=...' \ -F 'Policy=...' \ -F 'X-Amz-Signature=...' \ -F 'file=@cat.png' ```