> ## Documentation Index > Fetch the complete documentation index at: https://docs.maxcare.ai/llms.txt > Use this file to discover all available pages before exploring further. # List candidate source documents for a prior authorization > Returns the documents on this authorization's patient that look like authorization paperwork, best match first. These are CANDIDATES, not a definitive link: neither EHR marks a document as belonging to a specific prior authorization, so the platform ranks the patient's documents (authorization-number match first, then title/filename patterns) and the caller decides. `url` is present only for documents already staged in storage. Requires read:prior_authorizations scope. ## OpenAPI ````yaml /openapi-v2.json get /prior-authorizations/{id}/documents openapi: 3.0.0 info: title: Max AI Public API description: API for third-party marketplace apps version: '2.0' contact: {} servers: - url: https://api.maxcare.ai/v2 security: [] tags: [] paths: /prior-authorizations/{id}/documents: get: tags: - Prior Authorizations summary: List candidate source documents for a prior authorization description: >- Returns the documents on this authorization's patient that look like authorization paperwork, best match first. These are CANDIDATES, not a definitive link: neither EHR marks a document as belonging to a specific prior authorization, so the platform ranks the patient's documents (authorization-number match first, then title/filename patterns) and the caller decides. `url` is present only for documents already staged in storage. Requires read:prior_authorizations scope. operationId: PriorAuthorizationsPublicController_getPriorAuthorizationDocuments parameters: - name: id required: true in: path description: Prior authorization ID schema: type: string - name: X-Organization-Id in: header required: true schema: type: string description: Target clinic organization ID responses: '200': description: Success content: application/json: schema: $ref: >- #/components/schemas/GetPriorAuthorizationDocumentsSuccessResponse '400': description: Missing or invalid request parameter content: application/json: schema: $ref: '#/components/schemas/PublicApiBadRequestResponse' '401': description: Invalid or missing API key content: application/json: schema: $ref: '#/components/schemas/PublicApiUnauthorizedResponse' '403': description: Insufficient scope content: application/json: schema: $ref: '#/components/schemas/PublicApiForbiddenResponse' '404': description: Resource not found content: application/json: schema: $ref: '#/components/schemas/PublicApiNotFoundResponse' '429': description: Rate limit exceeded content: application/json: schema: $ref: '#/components/schemas/PublicApiRateLimitResponse' security: - api-key: [] components: schemas: GetPriorAuthorizationDocumentsSuccessResponse: type: object properties: code: type: string description: Response code example: success data: $ref: '#/components/schemas/PriorAuthorizationDocumentsResponse' required: - code - data PublicApiBadRequestResponse: type: object properties: code: type: string description: Error code example: bad_request message: type: string description: Human-readable error message example: '''id'' must be a valid UUID' trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiUnauthorizedResponse: type: object properties: code: type: string description: Error code example: unauthorized message: type: string description: Human-readable error message example: Invalid or missing API key trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiForbiddenResponse: type: object properties: code: type: string description: Error code example: forbidden message: type: string description: Human-readable error message example: Insufficient scope trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiNotFoundResponse: type: object properties: code: type: string description: Error code example: not_found message: type: string description: Human-readable error message example: Resource not found trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiRateLimitResponse: type: object properties: code: type: string description: Error code example: rate_limit_exceeded message: type: string description: Human-readable error message example: Rate limit exceeded. Maximum 1000 requests per 60 seconds. trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PriorAuthorizationDocumentsResponse: type: object properties: documents: description: >- Documents on this authorization's patient that look like authorization paperwork, best match first. CANDIDATES, not a definitive link: neither EHR marks a document as belonging to a specific prior authorization, so this is a ranked heuristic over the patient's documents (auth-number match, then title/filename patterns) and the caller decides. Empty when the authorization's patient cannot be resolved or nothing matches. type: array items: $ref: '#/components/schemas/PriorAuthorizationDocumentResponse' required: - documents PriorAuthorizationDocumentResponse: type: object properties: id: type: string description: Document reference id (scraping.patient_ehr_file_refs.id) example: b7c1e2d3-4f5a-4b6c-8d9e-0f1a2b3c4d5e name: type: string description: Document title as shown in the EHR example: Prior Auth Approval - Ilumya fileName: type: string description: Original filename nullable: true example: pa_approval.pdf mimeType: type: string description: MIME type nullable: true example: application/pdf sizeBytes: type: number description: Size in bytes nullable: true example: 148213 ehrCreatedAt: type: string description: When the document was created/uploaded in the EHR (ISO 8601) nullable: true example: '2026-02-10T14:03:11.000Z' downloaded: type: boolean description: >- Whether the bytes are already staged in our storage. False means the document exists in the EHR but has not been pulled yet, so `url` is null — staging requires a user-context connector the API key does not have. example: true url: type: string description: >- Short-lived signed URL to the document; null when it has not been staged yet nullable: true example: >- https://s3.amazonaws.com/ehr-files/patients/abc.pdf?X-Amz-Signature=... expiresInSeconds: type: number description: Seconds until `url` expires; null when there is no url nullable: true example: 3600 matchedAuthorizationNumber: type: boolean description: >- True when the authorization's own number appears in the document title or filename — a much stronger signal than the text heuristic, and these are returned first. example: false deletedFromEhrAt: type: string description: >- Set when a later EHR listing no longer returned this document (kept if already staged) nullable: true example: null required: - id - name - fileName - mimeType - sizeBytes - ehrCreatedAt - downloaded - url - expiresInSeconds - matchedAuthorizationNumber - deletedFromEhrAt securitySchemes: api-key: scheme: bearer bearerFormat: JWT type: http description: Marketplace API key ````