Topolo Docs Topolo Platform
Open workspace

List contract intakes

List retained uploads in the selected workspace before deciding whether another upload or analysis is needed.

List retained uploads in the selected workspace before deciding whether another upload or analysis is needed.

Access

Requires app_topolo_contracts.workspace:read and the intended authenticated organization and workspace. Select the permitted workspace through the supported resource-binding flow; do not add a workspace id to strict action input.

Steps

  1. Select the intended organization and workspace.
  2. Read the intake list and inspect source hashes, filenames, captured policies and status.
  3. Open the exact intake before acting; use the list to reconcile a lost upload response.

Identifiers

  • Intake UUIDs come from this scoped list or the retention response; filenames/titles alone are not unique identities.

Request

GET /api/intakes

Action: app_topolo_contracts.intakes.list.

Use the empty object {}. Resource/workspace selection belongs outside the action input; do not add undeclared fields.

Response and effects

  • Reads and decrypts all scoped retained intakes ordered by createdAt descending and applies the same public projection as intakes.get.
  • The source implements no pagination input here. An empty list is only a successful scoped empty snapshot, not a reason to bypass permission errors.
  • Do not treat analyzing/failed uploads as missing and submit duplicate documents. Internal source-object keys and full captured policy bodies are not returned.

Examples

Example request and response

Request input:

{}

Illustrated response:

{
  "intakes": [
    {
      "id": "11111111-1111-4111-8111-111111111111",
      "title": "Documentation specimen",
      "counterparty": "Example Beta",
      "contractType": "mutual_nda",
      "filename": "documentation-specimen.docx",
      "sha256": "6ca130ea78e011afbd4384bbe0ee82ea155a8bb65b7cad0f17932c3b402c6174",
      "status": "uploaded",
      "version": 1,
      "attempts": 0,
      "createdAt": "2026-10-21T00:00:00.000Z",
      "leaseUntil": null,
      "reviewId": null,
      "error": null,
      "policyId": "default",
      "policyVersion": 1,
      "policyApprovedBy": "user_documentation_fixture",
      "policyApprovedAt": "2026-10-21T00:00:00.000Z"
    }
  ]
}

HTTP 200 illustration. Hypothetical authorized operation only; inspect the action-specific fields and boundaries below.

Refusal or dependency failure

If: Authentication succeeded, but the verified principal has no organization id. The empty action input does not itself cause this; the source refuses before workspace resolution.

Request input:

{}

Source error-code excerpt (HTTP 403):

{
  "error": "organization_context_required"
}

Use the authorized organization rather than guessing a workspace across tenants.

Refusal or dependency failure

If: Workspace/protection checks succeeded, but the intake route receives a non-domain storage failure during its scoped read or persistence work. Its generic catch emits this code; prior write effects are not assumed absent.

Request input:

{}

Source error-code excerpt (HTTP 503):

{
  "error": "contract_intake_unavailable"
}

Retry the read after storage/protection recovery; no empty-result inference.

Verified empty intake list

Request input:

{}

Illustrated response:

{
  "intakes": []
}

HTTP 200 illustration. A 200 empty list means no retained intakes in this selected workspace at that snapshot.

Verify the result

  • Read a selected intake and compare its stable id, hash and current version before retrying a write.

Recovery

  • 403 organization_context_required: Use the authorized organization rather than guessing a workspace across tenants.
  • 503 contract_intake_unavailable: Retry the read after storage/protection recovery; no empty-result inference.
  • 401 authentication_required: Outer authentication/authorization contract: Authenticate again or provide a valid Topolo API key. Reconcile uncertain earlier write effects before any retry.
  • 403 permission_denied: Outer authentication/authorization contract: Grant the credential permission workspace:read and the required resource binding. Reconcile uncertain earlier write effects before any retry.
  • 429 rate_limited: Outer authentication/authorization contract: Wait for Retry-After when present, then retry without parallel duplicate calls. Reconcile uncertain earlier write effects before any retry.

Read-only; preserve scope and failure evidence. Use idempotent retention or explicit analysis recovery only when separately intended.

Source and example limits — 21 October 2026: based on reviewed Contracts source 4bfd49a; current serving association is unverified. All requests, responses, approvals and document specimens shown are fictional and unrun. Offline schema/ZIP/XML checks do not prove application acceptance, legal completeness, provider outcomes or human approval.