On this page
Authorized files in the integration
The Tenant API can list authorized assets at /assets and request permitted content at /assets/{asset_id}/content, after /v1/face-auth/transactions/{transaction_id}. These server-to-server calls require an API key, the document_download scope and an authorized IP.
See authentication and response types in the reference. Use identifiers returned by the listing; content authorization is checked separately and listing an asset does not release internal evidence.
Evidence ZIP and PDF are restricted
The /documents/download and /evidence.pdf routes do not provide downloads to Tenant integrations. Even with a valid key, scope and authorized IP, they return 403 evidence_access_restricted. Access to this evidence is reserved for internal Admin. The reference includes the routes to explain the restriction; the Postman requests exclude them.
Do not retry or broaden the key to bypass this denial. Knowing a link or identifier does not grant access. Authentication, scope or IP errors may be returned before the evidence restriction.
Protect permitted content
The key must belong to the same Tenant and environment as the transaction. Transfer only authorized content necessary for the approved purpose. Control who can open, export and share files in your application; avoid public caches and permanent unauthenticated URLs. Copies containing personal data also require safeguards and an appropriate retention policy.
For troubleshooting, send support identifiers and sanitized errors, never credentials or documents through open channels. Available records do not guarantee universal compliance or replace legal assessment of an agreement.