Authentication model

Authenticate approved requests and understand user, organization, and permission checks.

Curated API operations require an HTTP bearer credential provisioned for an approved BriefCatch integration. Token issuance and identity-provider endpoints are deliberately absent from the API reference.

Authorization: Bearer YOUR_TOKEN

Authorization layers

• Identity — the credential resolves to one BriefCatch user.
• Organization context — where relevant, BriefCatch resolves the user’s active organization.
• Permission — each operation checks the required capability, such as document analysis or upload.
• Resource ownership — document and review-history operations are scoped to the authenticated user and organization context.
• Entitlement — plan or usage rules may block a request even when identity and permission checks pass.

Common responses

• 401 — the credential is missing, invalid, or expired.
• 403 — the identity is valid but lacks permission or resource access.
• 402 — the requested capability requires an active entitlement.
• 404 — the resource does not exist, has expired, or is not available to the caller.
• 429 — a quota or rate boundary was reached.

Do not infer that a resource belongs to another customer from a 403 or 404; clients should present a generic access message.