Extract document data using LLMs through a REST API

A manual export button is not an API

• If a person must click Export, every downstream job waits for that person.
• Scripts need a stable credential with a narrow scope. A browser session cookie is the wrong tool.
• The response needs predictable rows, metadata and errors that code can validate.
• A token that can do everything becomes a long-lived liability once it lands in a codebase.

How the API works

01. Create a scoped key

From the app header under Webhooks & API (or /app?modal=webhooks), mint a scoped key. Keys look like dd_live_<64 hex>. The server stores only their SHA-256 hash, and the full secret is shown exactly once. Manage (list, revoke) them from the same panel.

02. Pull extractions from /api/v1

GET /api/v1/extractions lists your tables with pagination and filtering; GET /api/v1/extractions/:id/export?format=csv|json|xlsx returns one in the format your pipeline consumes. Send your key via the Authorization: Bearer <key> header or X-API-Key header.

03. Or infer from a document

POST /api/v1/infer uploads a document (multipart/form-data) and runs the same extraction engine as the app, returning the structured table in the response. It counts as one API call. Successful hosted pages and Free or Starter BYOK pages draw from the monthly PE budget; Pro or Scale BYOK pages cost 0 PE. Extractions persist and trigger webhooks. The interactive POST /api/extract/infer remains for session-authenticated calls.

04. Feed it into your systems

The JSON shape drops straight into your pipeline: a procurement system ingesting invoice rows, a finance tool importing bank statement transactions. The shape is consistent, so one consumer handles every document type.

What the API exposes

The versioned API exposes the calls a document pipeline needs:

• Scoped keys: hashed at rest, revocable, secret shown once
• Authentication: Authorization: Bearer or X-API-Key
• Versioned endpoints: GET /api/v1/extractions, GET :id/export, POST /api/v1/infer
• Pagination & filters: page, limit, sort, order, doc_type
• Formats: CSV (UTF-8 BOM), JSON, XLSX
• Inference: POST /api/v1/infer (multipart upload)
• Usage metering: GET /api/v1/usage (calls vs monthly limit)
• Rate limiting: 60/min per key, 20/min inference

A realistic example

A two-call integration, start to finish:

Request and response examples

Export extraction as JSON

GET /api/v1/extractions/:id/export?format=json

curl -X GET \
  -H "Authorization: Bearer dd_live_a8f92b7c4d1e0394..." \
  "https://app.dynamitedocs.com/api/v1/extractions/ext_01j5x9b3/export?format=json"

{
  "id": "ext_01j5x9b3",
  "fileId": "file_8829f0",
  "fileName": "vendor_invoice_1092.pdf",
  "docType": "Invoice",
  "label": "August Operations",
  "columns": [
    "Invoice Number",
    "Date",
    "Vendor",
    "Description",
    "Line Total",
    "Tax",
    "Amount Due"
  ],
  "rows": [
    [
      "INV-1092",
      "2026-08-01",
      "Acme Industrial Ltd",
      "Precision CNC milling components",
      "$1,250.00",
      "$100.00",
      "$1,350.00"
    ]
  ],
  "metadata": {
    "vendor": "Acme Industrial Ltd",
    "invoice_number": "INV-1092",
    "total": "1350.00",
    "currency": "USD"
  },
  "confidence": 0.98,
  "fieldConfidence": {
    "Invoice Number": 0.99,
    "Amount Due": 0.98
  },
  "summary": "Vendor invoice from Acme Industrial Ltd totaling $1,350.00.",
  "createdAt": "2026-08-15T09:12:00.000Z"
}

Submit document for inference

POST /api/v1/infer

curl -X POST \
  -H "Authorization: Bearer dd_live_a8f92b7c4d1e0394..." \
  -F "[email protected]" \
  https://app.dynamitedocs.com/api/v1/infer

{
  "id": "ext_99a8b7",
  "fileId": "file_77c2d1",
  "fileName": "invoice.pdf",
  "docType": "Invoice",
  "columns": ["Invoice #", "Vendor", "Due Date", "Total"],
  "rows": [
    ["INV-4410", "Apex Logistics", "2026-08-30", "$3,420.00"]
  ],
  "metadata": {
    "vendor": "Apex Logistics",
    "total": "3420.00",
    "currency": "USD"
  },
  "confidence": 0.97,
  "createdAt": "2026-08-22T14:10:00.000Z"
}

List extractions with pagination

GET /api/v1/extractions?page=1&limit=20&sort=created_at&order=desc

curl -X GET \
  -H "X-API-Key: dd_live_a8f92b7c4d1e0394..." \
  "https://app.dynamitedocs.com/api/v1/extractions?page=1&limit=20&doc_type=Invoice"

{
  "data": [
    {
      "id": "ext_01j5x9b3",
      "fileId": "file_8829f0",
      "fileName": "vendor_invoice_1092.pdf",
      "docType": "Invoice",
      "columns": ["Invoice Number", "Vendor", "Amount Due"],
      "rows": [["INV-1092", "Acme Industrial Ltd", "$1,350.00"]],
      "confidence": 0.98,
      "createdAt": "2026-08-15T09:12:00.000Z"
    }
  ],
  "pagination": {
    "page": 1,
    "limit": 20,
    "total": 48,
    "totalPages": 3,
    "hasMore": true
  }
}

Check monthly API usage

GET /api/v1/usage

curl -X GET \
  -H "Authorization: Bearer dd_live_a8f92b7c4d1e0394..." \
  https://app.dynamitedocs.com/api/v1/usage

{
  "usage": {
    "month": "2026-08",
    "calls": 42,
    "limit": 5000,
    "remaining": 4958,
    "unlimited": false
  }
}

What the API does and does not

Does

• Provides key-authenticated access to extractions and export formats via versioned /api/v1 endpoints with Bearer or X-API-Key auth.
• Stores keys as SHA-256 hashes only and shows the raw secret exactly once at creation.
• Rate-limits per key and meters every call against the monthly allowance, with a usage endpoint.
• Enforces hosted page caps and the monthly PE budget on standalone inference. BYOK on Free and Starter is metered; BYOK on Pro and Scale is unlimited.

Does not

• Does not expose file, settings, account, or billing mutations. Those actions require your session.
• Does not allow API traffic to bypass rate limits, the monthly call allowance, or the processing budget.
• Does not store your key in plaintext anywhere on the server.

Why the API belongs in the baseline

A token-authenticated export turns every extraction into a stable data source for the systems you already run, no human in the loop, no session cookie in a script.

Read-only, hashed tokens are safe to embed in pipelines and vendor tools, which is the only kind of credential you should be committing to config.

Standalone inference gives you programmatic document reads with the same caps and budget as the app, so automation cannot quietly game the pricing model.

Questions, answered

Related integration articles

• How to extract document data with LLM models and your own keys