接API

Hanko AI API

Integrate Hanko AI legal intelligence directly into your workflows. All endpoints require a Bearer token obtained from your organization settings, except where noted.

API access is currently in closed beta. Contact sales@hanko.ai to request access.

Base URL

https://app.hanko.ai

Authentication

Authorization: Bearer <your-api-key>
X-Org-Id: <your-org-id>

API keys are scoped to your organization. All requests are logged with the key ID, timestamp, and token usage for billing and audit purposes.

Endpoints

POST/api/documents/uploadBusiness+

Upload a document (PDF or DOCX) for extraction and review.

POST/api/documents/{id}/reviewBusiness+

Trigger a full contract review by the Keiyaku Agent. Returns redlines, risk score, and citations.

GET/api/documents/{id}/review.htmlBusiness+

Download the standalone HTML redline report for a reviewed document.

GET/api/documents/{id}/review.pdfBusiness+

Download the annotated PDF with highlights and a summary page appended.

POST/api/stamps/issueEnterprise

Issue a Hanko Digital Stamp (ECDSA-P256) for a reviewed document meeting eligibility criteria.

GET/verify/{stamp_id}Public

Public verification endpoint. No authentication required. Returns stamp authenticity and document fingerprint.

GET/verify/report/{report_id}Public

Public Review Report verification. No authentication required. Returns the signed report metadata and the expected SHA-256 of the delivered PDF.

GET/verify/_pubkeyPublic

Public signing key (ECDSA P-256) as PEM and JWK, for verifying any stamp or report signature offline. No authentication required.

POST/api/qaBusiness+

Ask a legal question against your uploaded documents. Returns SSE streaming response with citations.

GET/api/webhooksBusiness+

Get your verification webhook configuration. Never returns the signing secret.

PUT/api/webhooksBusiness+

Set or replace your verification webhook URL. Returns the HMAC signing secret once, on create or rotation.

POST/api/webhooks/testBusiness+

Send a signed ping event to your configured endpoint and report the delivery result.

DELETE/api/webhooksBusiness+

Remove your verification webhook.

Verifying a signature yourself

Every Hanko stamp and Review Report is signed with ECDSA P-256 (SHA-256) over a canonical JSON payload. Anyone can verify a signature offline, with no account and no key from us beyond the public one. The public verification endpoints need no authentication.

# 1. fetch the stamp payload and signature

curl https://verify.hanko.ai/{stamp_id}

# 2. fetch the public key (PEM and JWK)

curl https://verify.hanko.ai/_pubkey

Then verify the base64 DER signature over the canonical JSON payload using the P-256 public key. A single changed byte in the payload, or in the referenced document, makes verification fail. For a plain-language explanation of what the stamp does and does not prove, see the digital stamp page.

Webhooks

Configure one webhook URL for your organization and Hanko AI will notify you the moment a counterparty verifies a stamp or Review Report you issued. Set it with PUT /api/webhooks (owner or admin, HTTPS only). The signing secret is returned once, on create or rotation, and never on a plain read. Delivery is best effort: a slow or failing endpoint never delays or blocks verification.

# delivered as an HTTPS POST with these headers

X-Hanko-Event: stamp.verified

X-Hanko-Timestamp: 1785000000

X-Hanko-Signature: sha256=<hex>

# body (canonical JSON)

{"event":"stamp.verified","issuer":"hanko-ai","target_id":"...","verified_at":"..."}

Verify each delivery by computing an HMAC-SHA256 over {timestamp}.{raw body} with your signing secret and comparing it to the X-Hanko-Signature header. Reject deliveries whose timestamp is not recent to prevent replay. Events: stamp.verified and report.verified.

Request API Access

API access is available on Business and Enterprise plans.

Contact Sales