Professional document sealing, verification, and credential management API.

Getting Started

The Credo API uses GraphQL over a single HTTP endpoint. All requests are POST to the endpoint below. Responses are JSON.

Interactive Playground — Test queries live in GraphiQL (requires HTTP Basic Auth credentials).

Authentication

Most operations require a Bearer token in the Authorization header:

Authorization: Bearer <access_token>

Obtain tokens via the login mutation. Access tokens expire in 15 minutes. Use refreshToken to rotate before expiry. See the Authentication Flow section for details.

Rate Limits

Scope	Limit	Applies To
Per-IP	100 req/min	All requests
Per-user	10 req/min	PDF operations, billing, AI, board search

Exceeding limits returns 429 (HTTP) or BILLING_RATE_LIMIT_EXCEEDED (GraphQL).

Query Limits

Protection	Default	Enterprise
Max depth	10 levels	10 levels
Query complexity	500	2,000
Mutation complexity	100	500
Request timeout	30s	60s
Max request body	16 MB	16 MB
Introspection	Disabled in prod	Disabled in prod

Error Format

All errors follow the GraphQL spec with structured extensions:

{
  "errors": [{
    "message": "Human-readable message",
    "extensions": {
      "code": "ERROR_CODE",
      "status_code": 400
    }
  }]
}

See the full Error Code Reference for the complete list.

File Uploads

File uploads use the GraphQL multipart request spec. Send a multipart/form-data request with operations, map, and file parts:

curl -X POST /v1/graphql \
  -H "Authorization: Bearer <token>" \
  -F operations='{"query":"mutation(:Upload!){uploadFile(file:){filename fileHash size contentType}}","variables":{"file":null}}' \
  -F map='{"0":["variables.file"]}' \
  -F 0=@document.pdf

Allowed types: PDF, PNG, JPEG, TIFF. Max size: 16 MB.

Pagination

List queries support Relay cursor-based pagination. Use *Connection queries (e.g. documentsConnection) with first/after or last/before arguments. Max page size is 100.

Automatic Persisted Queries (APQ)

Reduce bandwidth by sending a SHA-256 hash instead of the full query. Apollo iOS and Apollo Kotlin support this natively.

{
  "extensions": {
    "persistedQuery": {
      "version": 1,
      "sha256Hash": "<sha256-hex-lowercase>"
    }
  }
}

On cache miss, the server returns PERSISTED_QUERY_NOT_FOUND — retry with the full query body.

https://api.engineeringid.com/v1/graphql