Skip to main content
The Manuscript API serves the record behind a decision to the people entitled to it: the programme’s MSP and its reporting suites. This page covers what the manuscript holds, the twelve endpoints, how webhook deliveries are signed, and how the Intent ID joins the manuscript to the published score. A destination system receives the score: a valid request carrying the Intent ID. The manuscript is everything behind it: the scored diagnostic, the answers, the documents, the workflow and its signed PDF. Destinations never receive the manuscript.
The Manuscript API runs on Deployed’s production backend, WorkAuthor, at https://deployed.workauthor.com/api/v1. Calls are service to service with per-customer API keys, webhook deliveries are HMAC-SHA256 signed, and access is granted per programme. Everything on this page matches the service’s published v1 OpenAPI document.

​
What the manuscript holds

Each response carries the score, its description, per-section scores, every question and answer, notes, and the ranked outcomes the decision was made from.
Created from a template with a field payload and returned with an id and a URL. Each carries its full dated lifecycle: created, completed, published, in review, review completed, archived.
Who submitted, when, and every question and answer. Surveys have no score fields.
Includes the signed PDF: the evidence entry the Compliance File points at.
externalId on assessments and documents carries the Intent ID, so the manuscript and the published score join both ways with no lookup table. CreateDocumentBody.externalId declares a maximum of 64 characters; the assessment and document response schemas declare it as a plain nullable string.

​
Endpoints

All twelve operations are relative to https://deployed.workauthor.com/api/v1. List operations page with Page and PageSize. Every operation, parameter and schema is on the endpoint pages in this tab, generated from the service’s own OpenAPI document. Errors share one shape across every operation: type, title, status, an errors[] array of code, description and type, and a traceId.

​
Signed webhooks

Deliveries are signed so a receiver can prove they came from WorkAuthor. Verify every delivery in this order.
1

Read the raw request body

Use the body exactly as received. Never digest a parsed or re-serialised payload.
2

Compute a digest with each active signing key

For each of your active signing keys, compute the HMAC-SHA256 digest of the raw body and Base64-encode it. Several keys can be active at once during rotation.
3

Compare against every signature header

The request carries one or more X-Signature-HMAC-SHA256-{n} headers, one per active key on the sending side. Compare each computed digest against each header value with a timing-safe comparison. The numeric suffix is an identifier only; it maps to no particular key.
4

Accept on any match, otherwise reject

The request is valid if any computed digest matches any supplied header. A request with no valid signature is rejected, not queued.
POST /documents accepts an eventNotification so a single document can notify a chosen URL on chosen events. Signed webhooks quotes the rules and the vendor’s C# and Node.js examples in full, and Webhook events lists the event types. The reference verifier, with the rotation and timing-safe rules as tests, is adapter/webhook_verify.py in the composerID reference code.

​
One ID, score and manuscript

Every intent carries one Intent ID (itn_..., up to 64 characters). At publish time it lands in the destination record; at creation time it is written into the manuscript’s externalId. The same ID therefore finds the published score in the destination system and the full manuscript here, in either direction, with no lookup table.

​
Access

Manuscript access is granted per programme, to the MSP and reporting systems the client names, with API keys and signing keys issued at onboarding. The OpenAPI document declares no security scheme because API-key authentication is configured per customer, outside the specification. Manuscript credentials are separate from the Intent API’s: Authentication covers the Intent API only. Manuscript access is never part of a destination integration: destinations receive the score, not the manuscript. Score and manuscript explains the boundary.

​
Next steps

Signed webhooks

The signing rules as quoted from the OpenAPI document, with verifier examples.

Webhook events

The event types and the per-document notification configuration.

Score and manuscript

Why destinations receive the score and only the MSP receives the manuscript.