Requires snapreport:generate permission. See Authentication.

To include audio, images, PDFs, DOCX, or XLSX/XLS, send as multipart/form-data. Scalar fields are plain form fields; processes is a JSON-stringified array; notes is a JSON-stringified array of strings. Any form field whose value is a file is treated as binary evidence — field names don't matter.

1curl -X POST https://api.myqateam.com/api/v1/snapreport/analyze \
2  -H "Authorization: Bearer myqa_..." \
3  -F 'standard_id=<uuid>' \
4  -F 'language=en' \
5  -F 'processes=["<chapter-id>","<chapter-id>"]' \
6  -F 'notes=["Observed cold-chain logs for Q1."]' \
7  -F 'file_1=@interview.mp3' \
8  -F 'file_2=@fridge-temp-log.jpg' \
9  -F 'file_3=@haccp-plan.pdf'

Instead of uploading bytes, point us at a file you already hold in Google Cloud Storage. This is the recommended path for large audio: the recording is read directly from storage and never travels through the API request.

• gcs_uri — a gs://bucket/object URI. One-time setup: grant the Storage Object Viewer role on your bucket to the service account we provide, and tell us the bucket name so it can be registered against your API key. Buckets that are not registered are refused.
• url — a signed https://storage.googleapis.com/... URL. No IAM setup and no bucket registration: the signature in the URL is your own authorisation. Make sure it is still valid when you call us; we do not retry expired links.

Field names do not matter. Exactly as with file uploads, any field whose value is a gs:// URI or a Cloud Storage URL is treated as evidence — so file_1=@recording.mp3 and file_1=gs://your-bucket/recording.mp3 both work. Reserved fields (standard_id, language, processes, callback_url, callback_secret, notes, transcript) are never read as evidence.

The file type is detected from the file's actual content, not its extension or the type you declare. Declaring a type that disagrees with the bytes is rejected.

1# gs:// reference — recommended for large audio
2curl -X POST https://api.myqateam.com/api/v1/snapreport/analyze \
3  -H "Authorization: Bearer myqa_..." \
4  -H "Content-Type: application/json" \
5  -d '{
6    "standard_id": "<uuid>",
7    "language": "en",
8    "evidence": [
9      { "type": "audio", "gcs_uri": "gs://your-bucket/interviews/site-visit.mp3" }
10    ]
11  }'
12
13# Signed URL — no IAM setup required
14curl -X POST https://api.myqateam.com/api/v1/snapreport/analyze \
15  -H "Authorization: Bearer myqa_..." \
16  -H "Content-Type: application/json" \
17  -d '{
18    "standard_id": "<uuid>",
19    "evidence": [
20      { "type": "audio", "url": "https://storage.googleapis.com/your-bucket/site-visit.mp3?X-Goog-Signature=..." }
21    ]
22  }'

Limits are identical whether a file is uploaded or referenced.

• Images: 20 MB each. JPEG, PNG, WebP, GIF.
• PDFs: 20 MB each.
• DOCX / XLSX / XLS: 20 MB each. Text is extracted server-side (charts and embedded images are dropped) and clipped at ~500K characters. Legacy .doc is not supported — save as .docx first.
• Audio: 200 MB each. MP3, WAV, AAC, FLAC, WebM, M4A, MP4, OGG. For anything large, prefer gcs_uri — an upload of this size in a single request is far more likely to fail in transit.

When the job completes we send an HTTP POST to your callback_url with Content-Type: application/json. The request body is the JSON object shown below — the same data object you would have received synchronously, wrapped with job_id and success. If callback_secret was supplied, the request carries an X-Webhook-Signature header containing an HMAC-SHA256 hex digest of the raw body. Deliveries are best-effort and not retried — every attempt is recorded with response status, duration, and any error.

We do not authenticate the call to your endpoint with a Bearer token. Either verify the X-Webhook-Signature header using callback_secret, or include a hard-to-guess token in the URL itself (e.g. https://example.com/webhooks/snapreport/<random-token>).

Successful job payload

1{
2  "job_id": "…",
3  "success": true,
4  "data": {
5    "standard": { "id": "…", "code": "ISO 9001", "name": "ISO 9001:2015" },
6    "language": "en",
7    "suggestions": [ /* same shape as the sync response */ ],
8    "validation_status": "pending_validation",
9    "requires_human_validation": true,
10    "notes_processed": 2,
11    "clauses_scanned": 46,
12    "processing_time_ms": 38211,
13    "token_usage": { "input_tokens": 14200, "output_tokens": 3800 }
14  }
15}

Failed job payload

1{
2  "job_id": "…",
3  "success": false,
4  "error": { "code": "PROCESSING_ERROR", "message": "…" }
5}

Your endpoint should respond with 2xx within ~10 seconds; non-2xx responses are recorded but not retried.

See the full error code reference on the authentication page.