Stable API foundation
api.subsum.io as canonical endpoint with versioned public routes under /api/public/v1.
Integrate Subsumio into legal software, client portals, and workflow automation with a token-based, versioned, production-ready API surface.
api.subsum.io as canonical endpoint with versioned public routes under /api/public/v1.
Bearer access tokens with workspace and document permissions based on the existing role model.
List workspaces, read workspace metadata, fetch document lists, and consume document metadata for downstream automation.
Production endpoint
https://api.subsum.io
Go from token to production-grade data retrieval in three steps.
Discovery (no token required)
curl -s https://api.subsum.io/api/public/v1/metaList workspaces (Bearer token)
curl -s -H "Authorization: Bearer <ACCESS_TOKEN>" "https://api.subsum.io/api/public/v1/workspaces?page=1&pageSize=25"Export document content as markdown
curl -s -H "Authorization: Bearer <ACCESS_TOKEN>" "https://api.subsum.io/api/public/v1/workspaces/<WORKSPACE_ID>/documents/<DOC_ID>/content"Search workspace documents
curl -s -H "Authorization: Bearer <ACCESS_TOKEN>" "https://api.subsum.io/api/public/v1/workspaces/<WORKSPACE_ID>/search?query=deadline&limit=20"Resolve blob download URL for attachments
curl -s -H "Authorization: Bearer <ACCESS_TOKEN>" "https://api.subsum.io/api/public/v1/workspaces/<WORKSPACE_ID>/blobs/<BLOB_KEY>"Create document from markdown
curl -s -X POST -H "Authorization: Bearer <ACCESS_TOKEN>" -H "Content-Type: application/json" -d "{"title":"New file","content":"# New file\nDraft text"}" "https://api.subsum.io/api/public/v1/workspaces/<WORKSPACE_ID>/documents"Update document title/content
curl -s -X PATCH -H "Authorization: Bearer <ACCESS_TOKEN>" -H "Content-Type: application/json" -d "{"title":"New file v2","content":"# New file v2\nUpdated text"}" "https://api.subsum.io/api/public/v1/workspaces/<WORKSPACE_ID>/documents/<DOC_ID>"Delete document
curl -s -X DELETE -H "Authorization: Bearer <ACCESS_TOKEN>" "https://api.subsum.io/api/public/v1/workspaces/<WORKSPACE_ID>/documents/<DOC_ID>"List webhook subscriptions
curl -s -H "Authorization: Bearer <ACCESS_TOKEN>" "https://api.subsum.io/api/public/v1/workspaces/<WORKSPACE_ID>/webhooks"Create webhook subscription (idempotent)
curl -s -X POST -H "Authorization: Bearer <ACCESS_TOKEN>" -H "Idempotency-Key: webhook-create-001" -H "Content-Type: application/json" -d "{"url":"https://example.com/subsumio/webhook","events":["document.created","document.updated"]}" "https://api.subsum.io/api/public/v1/workspaces/<WORKSPACE_ID>/webhooks"List webhook delivery logs
curl -s -H "Authorization: Bearer <ACCESS_TOKEN>" "https://api.subsum.io/api/public/v1/workspaces/<WORKSPACE_ID>/webhook-deliveries?status=failed&page=1&pageSize=25"Get single delivery with attempts
curl -s -H "Authorization: Bearer <ACCESS_TOKEN>" "https://api.subsum.io/api/public/v1/workspaces/<WORKSPACE_ID>/webhook-deliveries/<DELIVERY_ID>"Replay failed delivery
curl -s -X POST -H "Authorization: Bearer <ACCESS_TOKEN>" -H "Idempotency-Key: replay-delivery-001" "https://api.subsum.io/api/public/v1/workspaces/<WORKSPACE_ID>/webhook-deliveries/<DELIVERY_ID>/replay"Send Idempotency-Key on mutating endpoints (POST/PATCH/DELETE) to deduplicate safe retries.
Webhook events are signed via X-Subsumio-Signature (format: v1=<hmac_sha256>). Verify using HMAC(secret, "<timestamp>.<raw_body>") with X-Subsumio-Event-Timestamp.
Delivery behavior: up to 4 attempts with backoff (0s, 1.5s, 5s), 10s timeout per attempt. Status: pending → running → succeeded/failed. Delivery logs persisted in Postgres, accessible via /webhook-deliveries.
Errors and integration guidance