> ## Documentation Index > Fetch the complete documentation index at: https://docs.maxcare.ai/llms.txt > Use this file to discover all available pages before exploring further. # List source documents for a prior authorization > Returns the authorization's documents, best match first. Documents the EHR itself attaches to the authorization come first with `linked: true` (ModMed authorization attachments). After them come CANDIDATES from the patient's chart: documents carrying the authorization number, then documents whose title/filename look like authorization paperwork. Candidates are guesses the caller must judge. `url` is present only for staged documents; stage the rest with POST /patients/{patientId}/documents/{id}/fetch (read:patient_documents), since `id` is a patient document id. Requires read:prior_authorizations scope. ## OpenAPI ````yaml /openapi-v2.json get /prior-authorizations/{id}/documents openapi: 3.0.0 info: title: Max AI Public API description: API for third-party marketplace apps version: '2.0' contact: {} servers: - url: https://api.maxcare.ai/v2 security: [] tags: [] paths: /prior-authorizations/{id}/documents: get: tags: - Prior Authorizations summary: List source documents for a prior authorization description: >- Returns the authorization's documents, best match first. Documents the EHR itself attaches to the authorization come first with `linked: true` (ModMed authorization attachments). After them come CANDIDATES from the patient's chart: documents carrying the authorization number, then documents whose title/filename look like authorization paperwork. Candidates are guesses the caller must judge. `url` is present only for staged documents; stage the rest with POST /patients/{patientId}/documents/{id}/fetch (read:patient_documents), since `id` is a patient document id. Requires read:prior_authorizations scope. operationId: PriorAuthorizationsPublicController_getPriorAuthorizationDocuments parameters: - name: id required: true in: path description: Prior authorization ID schema: type: string - name: X-Organization-Id in: header required: true schema: type: string description: Target clinic organization ID responses: '200': description: Success content: application/json: schema: $ref: >- #/components/schemas/GetPriorAuthorizationDocumentsSuccessResponse '400': description: Missing or invalid request parameter content: application/json: schema: $ref: '#/components/schemas/PublicApiBadRequestResponse' '401': description: Invalid or missing API key content: application/json: schema: $ref: '#/components/schemas/PublicApiUnauthorizedResponse' '403': description: Insufficient scope content: application/json: schema: $ref: '#/components/schemas/PublicApiForbiddenResponse' '404': description: Resource not found content: application/json: schema: $ref: '#/components/schemas/PublicApiNotFoundResponse' '429': description: Rate limit exceeded content: application/json: schema: $ref: '#/components/schemas/PublicApiRateLimitResponse' security: - api-key: [] components: schemas: GetPriorAuthorizationDocumentsSuccessResponse: type: object properties: code: type: string description: Response code example: success data: $ref: '#/components/schemas/PriorAuthorizationDocumentsResponse' required: - code - data PublicApiBadRequestResponse: type: object properties: code: type: string description: Error code example: bad_request message: type: string description: Human-readable error message example: '''id'' must be a valid UUID' trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiUnauthorizedResponse: type: object properties: code: type: string description: Error code example: unauthorized message: type: string description: Human-readable error message example: Invalid or missing API key trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiForbiddenResponse: type: object properties: code: type: string description: Error code example: forbidden message: type: string description: Human-readable error message example: Insufficient scope trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiNotFoundResponse: type: object properties: code: type: string description: Error code example: not_found message: type: string description: Human-readable error message example: Resource not found trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiRateLimitResponse: type: object properties: code: type: string description: Error code example: rate_limit_exceeded message: type: string description: Human-readable error message example: Rate limit exceeded. Maximum 1000 requests per 60 seconds. trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PriorAuthorizationDocumentsResponse: type: object properties: documents: description: >- Documents for this authorization, best match first: documents the EHR links to the authorization (`linked: true`), then candidates from the patient's chart matched by authorization number, then by title/filename pattern. Candidates are guesses the caller must judge. The full set is returned; there is no paging. Empty when the authorization's patient cannot be resolved or nothing matches. type: array items: $ref: '#/components/schemas/PriorAuthorizationDocumentResponse' totalCount: type: number description: Number of entries in `documents` (always the complete set) example: 2 linkedNotListedCount: type: number description: >- Documents the EHR links to this authorization that are missing from the patient's cached chart listing, so they cannot appear in `documents`. A chart refresh (POST /patients/{id}/documents/refresh, read:patient_documents) may surface them; a count that survives a refresh means those links do not resolve to chart documents, so do not retry indefinitely. When the authorization's patient does not resolve, `documents` is empty, every link is counted here, and there is no patient to refresh. example: 0 required: - documents - totalCount - linkedNotListedCount PriorAuthorizationDocumentResponse: type: object properties: id: type: string description: Document reference id (scraping.patient_ehr_file_refs.id) example: b7c1e2d3-4f5a-4b6c-8d9e-0f1a2b3c4d5e name: type: string description: Document title as shown in the EHR example: Prior Auth Approval - Ilumya fileName: type: string description: Original filename nullable: true example: pa_approval.pdf mimeType: type: string description: MIME type nullable: true example: application/pdf sizeBytes: type: number description: Size in bytes nullable: true example: 148213 ehrCreatedAt: type: string description: When the document was created/uploaded in the EHR (ISO 8601) nullable: true example: '2026-02-10T14:03:11.000Z' downloaded: type: boolean description: >- Whether the bytes are already staged in our storage. False means the document exists in the EHR but has not been pulled yet, so `url` is null. POST /patients/{patientId}/documents/{id}/fetch (read:patient_documents) attempts the pull; see that route for its `unavailable`, 404 and 429 outcomes. example: true url: type: string description: >- Short-lived signed URL to the document; null when it has not been staged yet nullable: true example: >- https://s3.amazonaws.com/ehr-files/patients/abc.pdf?X-Amz-Signature=... expiresInSeconds: type: number description: Seconds until `url` expires; null when there is no url nullable: true example: 3600 kind: type: string description: >- Best-effort document type from the EHR category and title — the same classifier and vocabulary as GET /patients/{id}/documents. `other` when nothing identifies it. enum: - insurance_card - identification - prior_auth - clinical - other example: prior_auth linked: type: boolean description: >- True when the EHR itself attaches this document to the authorization (ModMed authorization attachments). An exact link, not a guess; linked documents are returned first. False means a candidate matched by authorization number or title only. example: true matchedAuthorizationNumber: type: boolean description: >- True when the authorization's own number appears in the document title or filename — a much stronger signal than the text heuristic. Among candidates (`linked: false`) these come first; every linked document precedes them. example: false deletedFromEhrAt: type: string description: >- Set when a later EHR listing no longer returned this document (kept if already staged) nullable: true example: null required: - id - name - fileName - mimeType - sizeBytes - ehrCreatedAt - downloaded - url - expiresInSeconds - kind - linked - matchedAuthorizationNumber - deletedFromEhrAt securitySchemes: api-key: scheme: bearer bearerFormat: JWT type: http description: Marketplace API key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.