GET

A report PDF of one of your orders

GET/api/vendor/v1/orders/{order_id}/files/{service}

The MVR, PSP or CDLIS report as a PDF, once its service is completed (its file_url). Only a file checked as a real PDF is served: the MVR is the report Sentinel rendered (never the state's own document), and the CDLIS report never shows the SSN. Anything else, including a report that is not ready, held for review or missing from storage, is 404. Each download is recorded.

Authorization

X-API-Keystringrequired
The environment's prefix (snt_test_ on this server; GET /me returns the environment), 8 characters, _, then the secret. Shown once, when the key is created in the Sentinel Developers portal. A key works only against the server that issued it.

Path parameters

order_idstring · uuidrequired
servicestringrequired
One of: mvr, psp, cdlis

Responses

200The PDF, as an attachment.application/pdf
- Content-Dispositionheader · string
  attachment; filename="sentinel-<service>-<order_id>.pdf".
- Cache-Controlheader · string
  no-store: order results are never cached.
- X-Content-Type-Optionsheader · string
  nosniff.
401invalid_api_key or api_key_expired.
- WWW-Authenticateheader · string
- errorobjectrequired
  ShowHide 4 fields
  order_idstring · uuid
  idempotency_conflict only: the order the key already belongs to.
  codestringrequired
  
  validation_error (400): the request is not valid; see fields.
  
  invalid_api_key (401): no key, a malformed, unknown or revoked key, or a key this server did not issue.
  
  api_key_expired (401): the key is past its 90 days. Create a new one.
  
  account_not_approved (403): staff have not approved the account yet.
  
  account_suspended (403): the account is suspended. Results can still be read; new orders are refused.
  
  service_not_enabled (403): an order names a service that is not enabled for the account (or none is).
  
  permission_denied (403): any other refusal.
  
  not_found (404): no such path or object. Any unknown path under /api/vendor/ answers this, with or without a key; so does an order that is not yours (exactly like one that does not exist) and a report that can't be downloaded now.
  
  method_not_allowed (405).
  
  idempotency_conflict (409): the Idempotency-Key was already used for a different order (error.order_id).
  
  in_progress (409): an order with this Idempotency-Key is still being placed; see Retry-After.
  
  payload_too_large (413): the request body or an image is too large.
  
  unsupported_media_type (415): the request body or an image has the wrong type.
  
  mvr_state_unavailable (422): MVR can't be ordered for the license state through the vendor API.
  
  rate_limited (429): see Retry-After. Also answered, instead of 401, after more than 100 failed keys from one address or 10 on one key in 10 minutes.
  
  internal_error (500).
  
  rate_limit_unavailable (503): try again shortly.
  
  price_unavailable (503): a service can't be priced right now.
  
  request_failed: any other error, with its HTTP status.
  
  One of: validation_error, invalid_api_key, api_key_expired, account_not_approved, account_suspended, service_not_enabled, permission_denied, not_found, method_not_allowed, idempotency_conflict, in_progress, payload_too_large, unsupported_media_type, mvr_state_unavailable, rate_limited, internal_error, rate_limit_unavailable, price_unavailable, request_failed
  messagestringrequired
  For people; may change. Use code in your code.
  fieldsobject | nullrequired
  Per-field messages, for validation errors.
403account_not_approved.
- errorobjectrequired
  ShowHide 4 fields
  order_idstring · uuid
  idempotency_conflict only: the order the key already belongs to.
  codestringrequired
  
  validation_error (400): the request is not valid; see fields.
  
  invalid_api_key (401): no key, a malformed, unknown or revoked key, or a key this server did not issue.
  
  api_key_expired (401): the key is past its 90 days. Create a new one.
  
  account_not_approved (403): staff have not approved the account yet.
  
  account_suspended (403): the account is suspended. Results can still be read; new orders are refused.
  
  service_not_enabled (403): an order names a service that is not enabled for the account (or none is).
  
  permission_denied (403): any other refusal.
  
  not_found (404): no such path or object. Any unknown path under /api/vendor/ answers this, with or without a key; so does an order that is not yours (exactly like one that does not exist) and a report that can't be downloaded now.
  
  method_not_allowed (405).
  
  idempotency_conflict (409): the Idempotency-Key was already used for a different order (error.order_id).
  
  in_progress (409): an order with this Idempotency-Key is still being placed; see Retry-After.
  
  payload_too_large (413): the request body or an image is too large.
  
  unsupported_media_type (415): the request body or an image has the wrong type.
  
  mvr_state_unavailable (422): MVR can't be ordered for the license state through the vendor API.
  
  rate_limited (429): see Retry-After. Also answered, instead of 401, after more than 100 failed keys from one address or 10 on one key in 10 minutes.
  
  internal_error (500).
  
  rate_limit_unavailable (503): try again shortly.
  
  price_unavailable (503): a service can't be priced right now.
  
  request_failed: any other error, with its HTTP status.
  
  One of: validation_error, invalid_api_key, api_key_expired, account_not_approved, account_suspended, service_not_enabled, permission_denied, not_found, method_not_allowed, idempotency_conflict, in_progress, payload_too_large, unsupported_media_type, mvr_state_unavailable, rate_limited, internal_error, rate_limit_unavailable, price_unavailable, request_failed
  messagestringrequired
  For people; may change. Use code in your code.
  fieldsobject | nullrequired
  Per-field messages, for validation errors.
404not_found.
- errorobjectrequired
  ShowHide 4 fields
  order_idstring · uuid
  idempotency_conflict only: the order the key already belongs to.
  codestringrequired
  
  validation_error (400): the request is not valid; see fields.
  
  invalid_api_key (401): no key, a malformed, unknown or revoked key, or a key this server did not issue.
  
  api_key_expired (401): the key is past its 90 days. Create a new one.
  
  account_not_approved (403): staff have not approved the account yet.
  
  account_suspended (403): the account is suspended. Results can still be read; new orders are refused.
  
  service_not_enabled (403): an order names a service that is not enabled for the account (or none is).
  
  permission_denied (403): any other refusal.
  
  not_found (404): no such path or object. Any unknown path under /api/vendor/ answers this, with or without a key; so does an order that is not yours (exactly like one that does not exist) and a report that can't be downloaded now.
  
  method_not_allowed (405).
  
  idempotency_conflict (409): the Idempotency-Key was already used for a different order (error.order_id).
  
  in_progress (409): an order with this Idempotency-Key is still being placed; see Retry-After.
  
  payload_too_large (413): the request body or an image is too large.
  
  unsupported_media_type (415): the request body or an image has the wrong type.
  
  mvr_state_unavailable (422): MVR can't be ordered for the license state through the vendor API.
  
  rate_limited (429): see Retry-After. Also answered, instead of 401, after more than 100 failed keys from one address or 10 on one key in 10 minutes.
  
  internal_error (500).
  
  rate_limit_unavailable (503): try again shortly.
  
  price_unavailable (503): a service can't be priced right now.
  
  request_failed: any other error, with its HTTP status.
  
  One of: validation_error, invalid_api_key, api_key_expired, account_not_approved, account_suspended, service_not_enabled, permission_denied, not_found, method_not_allowed, idempotency_conflict, in_progress, payload_too_large, unsupported_media_type, mvr_state_unavailable, rate_limited, internal_error, rate_limit_unavailable, price_unavailable, request_failed
  messagestringrequired
  For people; may change. Use code in your code.
  fieldsobject | nullrequired
  Per-field messages, for validation errors.
429rate_limited. 120 reads and 10 orders a minute per vendor, across all of its keys.
- Retry-Afterheader · integer
  Seconds to wait before trying again.
- errorobjectrequired
  ShowHide 4 fields
  order_idstring · uuid
  idempotency_conflict only: the order the key already belongs to.
  codestringrequired
  
  validation_error (400): the request is not valid; see fields.
  
  invalid_api_key (401): no key, a malformed, unknown or revoked key, or a key this server did not issue.
  
  api_key_expired (401): the key is past its 90 days. Create a new one.
  
  account_not_approved (403): staff have not approved the account yet.
  
  account_suspended (403): the account is suspended. Results can still be read; new orders are refused.
  
  service_not_enabled (403): an order names a service that is not enabled for the account (or none is).
  
  permission_denied (403): any other refusal.
  
  not_found (404): no such path or object. Any unknown path under /api/vendor/ answers this, with or without a key; so does an order that is not yours (exactly like one that does not exist) and a report that can't be downloaded now.
  
  method_not_allowed (405).
  
  idempotency_conflict (409): the Idempotency-Key was already used for a different order (error.order_id).
  
  in_progress (409): an order with this Idempotency-Key is still being placed; see Retry-After.
  
  payload_too_large (413): the request body or an image is too large.
  
  unsupported_media_type (415): the request body or an image has the wrong type.
  
  mvr_state_unavailable (422): MVR can't be ordered for the license state through the vendor API.
  
  rate_limited (429): see Retry-After. Also answered, instead of 401, after more than 100 failed keys from one address or 10 on one key in 10 minutes.
  
  internal_error (500).
  
  rate_limit_unavailable (503): try again shortly.
  
  price_unavailable (503): a service can't be priced right now.
  
  request_failed: any other error, with its HTTP status.
  
  One of: validation_error, invalid_api_key, api_key_expired, account_not_approved, account_suspended, service_not_enabled, permission_denied, not_found, method_not_allowed, idempotency_conflict, in_progress, payload_too_large, unsupported_media_type, mvr_state_unavailable, rate_limited, internal_error, rate_limit_unavailable, price_unavailable, request_failed
  messagestringrequired
  For people; may change. Use code in your code.
  fieldsobject | nullrequired
  Per-field messages, for validation errors.
503rate_limit_unavailable.
- Retry-Afterheader · integer
  Seconds to wait before trying again.
- errorobjectrequired
  ShowHide 4 fields
  order_idstring · uuid
  idempotency_conflict only: the order the key already belongs to.
  codestringrequired
  
  validation_error (400): the request is not valid; see fields.
  
  invalid_api_key (401): no key, a malformed, unknown or revoked key, or a key this server did not issue.
  
  api_key_expired (401): the key is past its 90 days. Create a new one.
  
  account_not_approved (403): staff have not approved the account yet.
  
  account_suspended (403): the account is suspended. Results can still be read; new orders are refused.
  
  service_not_enabled (403): an order names a service that is not enabled for the account (or none is).
  
  permission_denied (403): any other refusal.
  
  not_found (404): no such path or object. Any unknown path under /api/vendor/ answers this, with or without a key; so does an order that is not yours (exactly like one that does not exist) and a report that can't be downloaded now.
  
  method_not_allowed (405).
  
  idempotency_conflict (409): the Idempotency-Key was already used for a different order (error.order_id).
  
  in_progress (409): an order with this Idempotency-Key is still being placed; see Retry-After.
  
  payload_too_large (413): the request body or an image is too large.
  
  unsupported_media_type (415): the request body or an image has the wrong type.
  
  mvr_state_unavailable (422): MVR can't be ordered for the license state through the vendor API.
  
  rate_limited (429): see Retry-After. Also answered, instead of 401, after more than 100 failed keys from one address or 10 on one key in 10 minutes.
  
  internal_error (500).
  
  rate_limit_unavailable (503): try again shortly.
  
  price_unavailable (503): a service can't be priced right now.
  
  request_failed: any other error, with its HTTP status.
  
  One of: validation_error, invalid_api_key, api_key_expired, account_not_approved, account_suspended, service_not_enabled, permission_denied, not_found, method_not_allowed, idempotency_conflict, in_progress, payload_too_large, unsupported_media_type, mvr_state_unavailable, rate_limited, internal_error, rate_limit_unavailable, price_unavailable, request_failed
  messagestringrequired
  For people; may change. Use code in your code.
  fieldsobject | nullrequired
  Per-field messages, for validation errors.

curl --fail-with-body https://api-demo-safety.spotter.ai/api/vendor/v1/orders/3f2b9c1e-7a4d-4e8b-9c61-5d0a8e2f4b17/files/mvr \
  -H "X-API-Key: YOUR_API_KEY" \
  -OJ

import { writeFile } from "node:fs/promises";

const res = await fetch("https://api-demo-safety.spotter.ai/api/vendor/v1/orders/3f2b9c1e-7a4d-4e8b-9c61-5d0a8e2f4b17/files/mvr", {
  headers: { "X-API-Key": "YOUR_API_KEY" },
});
if (!res.ok) throw new Error(`${res.status}: ${await res.text()}`);
await writeFile("report.pdf", Buffer.from(await res.arrayBuffer()));

import requests

with requests.get(
    "https://api-demo-safety.spotter.ai/api/vendor/v1/orders/3f2b9c1e-7a4d-4e8b-9c61-5d0a8e2f4b17/files/mvr",
    headers={"X-API-Key": "YOUR_API_KEY"},
    stream=True,
) as res:
    res.raise_for_status()
    with open("report.pdf", "wb") as f:
        for chunk in res.iter_content(chunk_size=65536):
            f.write(chunk)

application/pdf