Menu de la documentation : Events

Events

What happened in your account, kept for polling and catching up.

La référence de l’API n’existe qu’en anglais, comme l’API.

Sur cette page

List events
Retrieve an event

List events #

GET /api/v1/events

Returns the events of your key's mode, newest first, each exactly as webhooks deliver it. Filter by type, document, merchant and creation time; catch up after downtime by paging back to the last event you handled.

Bearer API key

Query parameters

limitinteger: How many items to return, 1 to 100; 10 by default.
From 1 to 100 · Default: 10
starting_afterstring: An id (evt_…) from this list: return the items after it, older ones (pass the last id of the current page). Not with ending_before.
Up to 64 characters
ending_beforestring: An id (evt_…) from this list: return the items before it, newer ones (pass the first id of the current page). Not with starting_after.
Up to 64 characters
typestring[]: Only events of these types; repeat the parameter for several (type=a&type=b).
1 to 20 items
documentstring: Only events about this document (doc_…).
Show patternHide pattern
^doc_[0-9A-Za-z]{22}$
merchantstring: Only events about this merchant or its documents and connections (mer_…).
Show patternHide pattern
^mer_[0-9A-Za-z]{22}$
created[gte]string: Only events created at or after this moment (ISO 8601, e.g. 2026-10-11T09:30:00Z).
Format: date-time
created[lte]string: Only events created at or before this moment (ISO 8601, e.g. 2026-10-11T09:30:00Z).
Format: date-time

Request

curl

curl -X GET 'https://tallio.dev/api/v1/events' \
  -H "Authorization: Bearer $TALLIO_API_KEY"

TypeScript SDK

import { createTallioClient, unwrap } from "@tallio/sdk";

const tallio = createTallioClient({
  apiKey: process.env.TALLIO_API_KEY!,
  baseUrl: "https://tallio.dev",
});

const result = await unwrap(tallio.http.GET("/api/v1/events"));

Responses
Status	Description
`200`	A page of events.
4XX, 5XX	An error: see Errors below.

Response body · 200

objectstringrequired

Always "list".

Always list

dataobject[]required

This page's items, newest first.

Each item: Something that happened in your account. Webhooks deliver these; consumers dedupe on id.

Show nested fields (13)

idstringrequired

Id of the event (evt_…).

Show pattern

^evt_[0-9A-Za-z]{22}$

objectstringrequired

Always "event".

Always event

typestringrequired

What happened: document.created (Tallio accepted a document), document.issued (it has a MARK), document.rejected (the provider or AADE refused it), document.failed (Tallio could not deliver it), merchant.created (a merchant was created), connection.created (a merchant was connected to a provider), connection.verified (the provider accepted its credentials), connection.invalid (the provider refused them), connection.disconnected (it was disconnected), connect_session.completed (a merchant connected through a hosted connect link), webhook_endpoint.disabled (Tallio disabled an endpoint failing for days) and document.retried (a failed document was queued to be sent again).

One of: document.created, document.issued, document.rejected, document.failed, merchant.created, connection.created, connection.verified, connection.invalid, connection.disconnected, connect_session.completed, webhook_endpoint.disabled, document.retried

createdstringrequired

When the event happened.

Format: date-time

api_versionstringrequired

The API version data.object is rendered in, e.g. 0.1.0.

livemodebooleanrequired

True for an event from live mode, false for test mode.

dataanyOfrequired

The object the event is about. Its kind follows from type (document.* carries a Document, merchant.* a Merchant, connection.* a Connection, connect_session.* a ConnectSession, webhook_endpoint.* a WebhookEndpoint); narrow on data.object.object.

dataobjectrequired

A document event's data: object is the document right after the event (data.object.object is "document").

Option 1 of 5

Show nested fields (2)

objectobjectrequired

A fiscal document Tallio issues through a provider, with its status and history.

Option 1 of 5

Show nested fields (23)

idstringrequired

Id of the document (doc_…).

Option 1 of 5

Show pattern

^doc_[0-9A-Za-z]{22}$

objectstringrequired

Always "document".

Option 1 of 5 · Always document

merchantstringrequired

Id of the merchant (mer_…).

Option 1 of 5

Show pattern

^mer_[0-9A-Za-z]{22}$

modestringrequired

live for a document created with a live key, test for a test key.

Option 1 of 5 · One of: live, test

providerstringrequired

The licensed e-invoicing provider (or direct myDATA, or Tallio's sandbox) that issues the document.

Option 1 of 5 · One of: sandbox, mydata, wrapp, impact, epsilon, softone, prosvasis

typestringrequired

AADE myDATA document type: 1.1 sales invoice, 2.1 service invoice, 5.1 credit note (associated), 5.2 credit note (non-associated), 11.1 retail sales receipt, 11.2 retail service receipt.

Option 1 of 5 · One of: 1.1, 2.1, 5.1, 5.2, 11.1, 11.2

statusstringrequired

Where the document stands: pending (Tallio accepted it; not yet issued, see stage), issued (has a MARK), rejected (the provider or AADE refused it), failed (Tallio could not deliver it to the provider).

Option 1 of 5 · One of: pending, issued, rejected, failed

stagestring | nullrequired

Where a pending document is (queued, submitting, awaiting_mark, reconciling); null unless status is pending.

Option 1 of 5 · One of: queued, submitting, awaiting_mark, reconciling

issue_datestringrequired

Issue date, YYYY-MM-DD.

Option 1 of 5 · Format: date

currencystringrequired

ISO 4217 currency. Only EUR for now.

Option 1 of 5 · Always EUR

netintegerrequired

Sum of the lines' net amounts, in minor units, at most 1000000000000000.

Option 1 of 5 · From 0 to 1000000000000000

vatintegerrequired

Sum of the lines' VAT, each line rounded half up to the minor unit, in minor units, at most 1000000000000000.

Option 1 of 5 · From 0 to 1000000000000000

grossintegerrequired

net + vat, in minor units, at most 1250000000000000.

Option 1 of 5 · From 0 to 1250000000000000

markstring | nullrequired

MARK (AADE registration number) once issued, as a digit string; null before.

Option 1 of 5

Show pattern

^[1-9]\d{0,18}$

uidstring | nullrequired

myDATA uid: the SHA-1 (40 upper-case hex digits) AADE derives from the document's identifiers; null until known.

Option 1 of 5

Show pattern

^[0-9A-F]{40}$

qr_urlstring | nullrequired

URL the document's QR code points to; null until the provider returns one.

Option 1 of 5 · Format: uri

errorobject | nullrequired

Why the document was rejected or failed; null otherwise.

Option 1 of 5

Show nested fields (6)

codestringrequired: Stable machine-readable error code. Branch on this, never on message.
Option 1 of 5 · One of: validation_failed, unauthorized, not_found, idempotency_conflict, idempotency_in_progress, already_exists, invalid_state, payload_too_large, unsupported_media_type, rate_limited, not_supported, connection_unavailable, provider_credentials_invalid, provider_rejected, provider_unavailable, service_unavailable, internal_error
messagestringrequired: Human-readable explanation, safe to show to a developer.
Option 1 of 5
provider_codestring | nullrequired: The provider's own error code, or null when the error did not come from a provider.
Option 1 of 5
provider_messagestring | nullrequired: The provider's own error message, verbatim, or null when the error did not come from a provider.
Option 1 of 5
retryablebooleanrequired: True when the same request may succeed if sent again later.
Option 1 of 5
provider_rawany: The provider's error response body as received, or a TruncatedProviderRaw marker when it exceeds 4096 bytes of JSON. Never holds request headers, credentials or the request payload.
Option 1 of 5

classificationobjectrequired

How the document was classified for myDATA.

Option 1 of 5

Show nested fields (2)

sourcestringrequired: default when any line took Tallio's default, else override when any line took the merchant's override, else line.
Option 1 of 5 · One of: line, override, default
warningsstring[]required: What to check before issuing, e.g. that defaults were applied.
Option 1 of 5
Each item: Option 1 of 5

external_referencestring | nullrequired

Your own reference for the document, or null.

Option 1 of 5 · Default: null

metadataobjectrequired

Up to 50 key-value pairs of your own (keys up to 40 characters, values up to 500). Do not put personal data in it.

Option 1 of 5 · Default: {}

Show nested fields (1)

{key}string: A value, up to 500 characters.
Option 1 of 5 · 1 to 40 characters

timelineobject[]required

The document's events, oldest first, at most 100.

Option 1 of 5 · Up to 100 items

Each item: One event in a document's history. GET /events/{id} returns the full Event. Option 1 of 5

Show nested fields (3)

idstringrequired: Id of the event (evt_…).
Option 1 of 5
Show patternHide pattern
^evt_[0-9A-Za-z]{22}$
typestringrequired: What happened: document.created (Tallio accepted a document), document.issued (it has a MARK), document.rejected (the provider or AADE refused it), document.failed (Tallio could not deliver it), merchant.created (a merchant was created), connection.created (a merchant was connected to a provider), connection.verified (the provider accepted its credentials), connection.invalid (the provider refused them), connection.disconnected (it was disconnected), connect_session.completed (a merchant connected through a hosted connect link), webhook_endpoint.disabled (Tallio disabled an endpoint failing for days) and document.retried (a failed document was queued to be sent again).
Option 1 of 5 · One of: document.created, document.issued, document.rejected, document.failed, merchant.created, connection.created, connection.verified, connection.invalid, connection.disconnected, connect_session.completed, webhook_endpoint.disabled, document.retried
createdstringrequired: When the event happened.
Option 1 of 5 · Format: date-time

createdstringrequired

When Tallio accepted the document.

Option 1 of 5 · Format: date-time

updatedstringrequired

When the document last changed.

Option 1 of 5 · Format: date-time

previous_attributesobject

The values the changed fields had before the event; absent for an event that changed nothing.

Option 1 of 5

Show nested fields (23)

idstring

Id of the document (doc_…).

Option 1 of 5

Show pattern

^doc_[0-9A-Za-z]{22}$

objectstring

Always "document".

Option 1 of 5 · Always document

merchantstring

Id of the merchant (mer_…).

Option 1 of 5

Show pattern

^mer_[0-9A-Za-z]{22}$

modestring

live for a document created with a live key, test for a test key.

Option 1 of 5 · One of: live, test

providerstring

The licensed e-invoicing provider (or direct myDATA, or Tallio's sandbox) that issues the document.

Option 1 of 5 · One of: sandbox, mydata, wrapp, impact, epsilon, softone, prosvasis

typestring

AADE myDATA document type: 1.1 sales invoice, 2.1 service invoice, 5.1 credit note (associated), 5.2 credit note (non-associated), 11.1 retail sales receipt, 11.2 retail service receipt.

Option 1 of 5 · One of: 1.1, 2.1, 5.1, 5.2, 11.1, 11.2

statusstring

Option 1 of 5 · One of: pending, issued, rejected, failed

stagestring | null

Where a pending document is (queued, submitting, awaiting_mark, reconciling); null unless status is pending.

Option 1 of 5 · One of: queued, submitting, awaiting_mark, reconciling

issue_datestring

Issue date, YYYY-MM-DD.

Option 1 of 5 · Format: date

currencystring

ISO 4217 currency. Only EUR for now.

Option 1 of 5 · Always EUR

netinteger

Sum of the lines' net amounts, in minor units, at most 1000000000000000.

Option 1 of 5 · From 0 to 1000000000000000

vatinteger

Sum of the lines' VAT, each line rounded half up to the minor unit, in minor units, at most 1000000000000000.

Option 1 of 5 · From 0 to 1000000000000000

grossinteger

net + vat, in minor units, at most 1250000000000000.

Option 1 of 5 · From 0 to 1250000000000000

markstring | null

MARK (AADE registration number) once issued, as a digit string; null before.

Option 1 of 5

Show pattern

^[1-9]\d{0,18}$

uidstring | null

myDATA uid: the SHA-1 (40 upper-case hex digits) AADE derives from the document's identifiers; null until known.

Option 1 of 5

Show pattern

^[0-9A-F]{40}$

qr_urlstring | null

URL the document's QR code points to; null until the provider returns one.

Option 1 of 5 · Format: uri

errorobject | null

Why the document was rejected or failed; null otherwise.

Option 1 of 5

Show nested fields (6)

codestringrequired: Stable machine-readable error code. Branch on this, never on message.
Option 1 of 5 · One of: validation_failed, unauthorized, not_found, idempotency_conflict, idempotency_in_progress, already_exists, invalid_state, payload_too_large, unsupported_media_type, rate_limited, not_supported, connection_unavailable, provider_credentials_invalid, provider_rejected, provider_unavailable, service_unavailable, internal_error
messagestringrequired: Human-readable explanation, safe to show to a developer.
Option 1 of 5
provider_codestring | nullrequired: The provider's own error code, or null when the error did not come from a provider.
Option 1 of 5
provider_messagestring | nullrequired: The provider's own error message, verbatim, or null when the error did not come from a provider.
Option 1 of 5
retryablebooleanrequired: True when the same request may succeed if sent again later.
Option 1 of 5
provider_rawany: The provider's error response body as received, or a TruncatedProviderRaw marker when it exceeds 4096 bytes of JSON. Never holds request headers, credentials or the request payload.
Option 1 of 5

classificationobject

How the document was classified for myDATA.

Option 1 of 5

Show nested fields (2)

sourcestringrequired: default when any line took Tallio's default, else override when any line took the merchant's override, else line.
Option 1 of 5 · One of: line, override, default
warningsstring[]required: What to check before issuing, e.g. that defaults were applied.
Option 1 of 5
Each item: Option 1 of 5

external_referencestring | null

Your own reference for the document, or null.

Option 1 of 5

metadataobject

Up to 50 key-value pairs of your own (keys up to 40 characters, values up to 500). Do not put personal data in it.

Option 1 of 5

Show nested fields (1)

{key}string: A value, up to 500 characters.
Option 1 of 5 · 1 to 40 characters

timelineobject[]

The document's events, oldest first, at most 100.

Option 1 of 5 · Up to 100 items

Each item: One event in a document's history. GET /events/{id} returns the full Event. Option 1 of 5

Show nested fields (3)

idstringrequired: Id of the event (evt_…).
Option 1 of 5
Show patternHide pattern
^evt_[0-9A-Za-z]{22}$
typestringrequired: What happened: document.created (Tallio accepted a document), document.issued (it has a MARK), document.rejected (the provider or AADE refused it), document.failed (Tallio could not deliver it), merchant.created (a merchant was created), connection.created (a merchant was connected to a provider), connection.verified (the provider accepted its credentials), connection.invalid (the provider refused them), connection.disconnected (it was disconnected), connect_session.completed (a merchant connected through a hosted connect link), webhook_endpoint.disabled (Tallio disabled an endpoint failing for days) and document.retried (a failed document was queued to be sent again).
Option 1 of 5 · One of: document.created, document.issued, document.rejected, document.failed, merchant.created, connection.created, connection.verified, connection.invalid, connection.disconnected, connect_session.completed, webhook_endpoint.disabled, document.retried
createdstringrequired: When the event happened.
Option 1 of 5 · Format: date-time

createdstring

When Tallio accepted the document.

Option 1 of 5 · Format: date-time

updatedstring

When the document last changed.

Option 1 of 5 · Format: date-time

dataobjectrequired

A merchant event's data: object is the merchant right after the event (data.object.object is "merchant").

Option 2 of 5

Show nested fields (2)

objectobjectrequired

A business that issues documents under your account.

Option 2 of 5

Show nested fields (9)

idstringrequired

Id of the merchant (mer_…).

Option 2 of 5

Show pattern

^mer_[0-9A-Za-z]{22}$

objectstringrequired

Always "merchant".

Option 2 of 5 · Always merchant

external_idstringrequired

Your own id for the merchant, e.g. a shop domain: 1 to 200 characters, trimmed, unique in your account ignoring case (Shop-A and shop-a are the same merchant). Find a merchant by it.

Option 2 of 5 · Up to 200 characters

Show pattern

\S

namestringrequired

The merchant's name, as you show it: 1 to 200 characters, trimmed.

Option 2 of 5 · Up to 200 characters

Show pattern

\S

tax_idstring | nullrequired

The merchant's ΑΦΜ, normalised, or null when not given.

Option 2 of 5

branchintegerrequired

Branch number in the AADE registry; 0 for the head office.

Option 2 of 5 · From 0 to 9007199254740991

metadataobjectrequired

Up to 50 key-value pairs of your own (keys up to 40 characters, values up to 500). Do not put personal data in it.

Option 2 of 5

Show nested fields (1)

{key}string: A value, up to 500 characters.
Option 2 of 5 · 1 to 40 characters

archivedbooleanrequired

True once the merchant is archived; it then issues nothing new.

Option 2 of 5

createdstringrequired

When the merchant was created.

Option 2 of 5 · Format: date-time

previous_attributesobject

The values the changed fields had before the event; absent for an event that changed nothing.

Option 2 of 5

Show nested fields (9)

idstring

Id of the merchant (mer_…).

Option 2 of 5

Show pattern

^mer_[0-9A-Za-z]{22}$

objectstring

Always "merchant".

Option 2 of 5 · Always merchant

external_idstring

Your own id for the merchant, e.g. a shop domain: 1 to 200 characters, trimmed, unique in your account ignoring case (Shop-A and shop-a are the same merchant). Find a merchant by it.

Option 2 of 5 · Up to 200 characters

Show pattern

\S

namestring

The merchant's name, as you show it: 1 to 200 characters, trimmed.

Option 2 of 5 · Up to 200 characters

Show pattern

\S

tax_idstring | null

The merchant's ΑΦΜ, normalised, or null when not given.

Option 2 of 5

branchinteger

Branch number in the AADE registry; 0 for the head office.

Option 2 of 5 · From 0 to 9007199254740991

metadataobject

Up to 50 key-value pairs of your own (keys up to 40 characters, values up to 500). Do not put personal data in it.

Option 2 of 5

Show nested fields (1)

{key}string: A value, up to 500 characters.
Option 2 of 5 · 1 to 40 characters

archivedboolean

True once the merchant is archived; it then issues nothing new.

Option 2 of 5

createdstring

When the merchant was created.

Option 2 of 5 · Format: date-time

dataobjectrequired

A connection event's data: object is the connection right after the event (data.object.object is "connection").

Option 3 of 5

Show nested fields (1)

objectobjectrequired

A merchant's credentials for one provider in one mode. The credentials themselves are never returned.

Option 3 of 5

Show nested fields (9)

idstringrequired

Id of the connection (con_…).

Option 3 of 5

Show pattern

^con_[0-9A-Za-z]{22}$

objectstringrequired

Always "connection".

Option 3 of 5 · Always connection

merchantstringrequired

The merchant this connection belongs to (mer_…).

Option 3 of 5

Show pattern

^mer_[0-9A-Za-z]{22}$

providerstringrequired

The licensed e-invoicing provider (or direct myDATA, or Tallio's sandbox) that issues the document.

Option 3 of 5 · One of: sandbox, mydata, wrapp, impact, epsilon, softone, prosvasis

modestringrequired

live for a connection made with a live key, test for a test key.

Option 3 of 5 · One of: live, test

statusstringrequired

active (documents can be routed to it), invalid (the provider refused its credentials; fix and verify again), disconnected (no longer used; its credentials are deleted 30 days later).

Option 3 of 5 · One of: active, invalid, disconnected

verified_atstring | nullrequired

When the provider last accepted its credentials; null until then.

Option 3 of 5 · Format: date-time

last_errorobject | nullrequired

Why the provider last refused it; null otherwise.

Option 3 of 5

Show nested fields (6)

codestringrequired: Stable machine-readable error code. Branch on this, never on message.
Option 3 of 5 · One of: validation_failed, unauthorized, not_found, idempotency_conflict, idempotency_in_progress, already_exists, invalid_state, payload_too_large, unsupported_media_type, rate_limited, not_supported, connection_unavailable, provider_credentials_invalid, provider_rejected, provider_unavailable, service_unavailable, internal_error
messagestringrequired: Human-readable explanation, safe to show to a developer.
Option 3 of 5
provider_codestring | nullrequired: The provider's own error code, or null when the error did not come from a provider.
Option 3 of 5
provider_messagestring | nullrequired: The provider's own error message, verbatim, or null when the error did not come from a provider.
Option 3 of 5
retryablebooleanrequired: True when the same request may succeed if sent again later.
Option 3 of 5
provider_rawany: The provider's error response body as received, or a TruncatedProviderRaw marker when it exceeds 4096 bytes of JSON. Never holds request headers, credentials or the request payload.
Option 3 of 5

createdstringrequired

When the connection was created.

Option 3 of 5 · Format: date-time

dataobjectrequired

A connect-session event's data: object is the session right after the event (data.object.object is "connect_session"); it never carries the link.

Option 4 of 5

Show nested fields (1)

objectobjectrequired

The connect session right after the event, without its one-time link.

Option 4 of 5

Show nested fields (6)

idstringrequired: Id of the connect session (cs_…).
Option 4 of 5
Show patternHide pattern
^cs_[0-9A-Za-z]{22}$
objectstringrequired: Always "connect_session".
Option 4 of 5 · Always connect_session
merchantstringrequired: The merchant being connected (mer_…).
Option 4 of 5
Show patternHide pattern
^mer_[0-9A-Za-z]{22}$
expires_atstringrequired: When the link stops working: 30 minutes after it was made.
Option 4 of 5 · Format: date-time
completed_atstring | nullrequired: When the merchant connected through it; null until then.
Option 4 of 5 · Format: date-time
connectionstring | nullrequired: The connection the merchant made through it (con_…), or null.
Option 4 of 5
Show patternHide pattern
^con_[0-9A-Za-z]{22}$

dataobjectrequired

A webhook-endpoint event's data: object is the endpoint right after the event (data.object.object is "webhook_endpoint").

Option 5 of 5

Show nested fields (1)

objectobjectrequired

A URL that receives your events, signed with its own secret.

Option 5 of 5

Show nested fields (9)

idstringrequired

Id of the webhook endpoint (we_…).

Option 5 of 5

Show pattern

^we_[0-9A-Za-z]{22}$

objectstringrequired

Always "webhook_endpoint".

Option 5 of 5 · Always webhook_endpoint

urlstringrequired

Where events are POSTed.

Option 5 of 5

enabled_eventsanyOf[]required

The event types delivered, or ["*"].

Option 5 of 5

Show nested fields (3)

enabled_events[]anyOfrequired: An event type to deliver, or * for every type.
Option 5 of 5
enabled_events[]stringrequired: What happened: document.created (Tallio accepted a document), document.issued (it has a MARK), document.rejected (the provider or AADE refused it), document.failed (Tallio could not deliver it), merchant.created (a merchant was created), connection.created (a merchant was connected to a provider), connection.verified (the provider accepted its credentials), connection.invalid (the provider refused them), connection.disconnected (it was disconnected), connect_session.completed (a merchant connected through a hosted connect link), webhook_endpoint.disabled (Tallio disabled an endpoint failing for days) and document.retried (a failed document was queued to be sent again).
Option 5 of 5 › Option 1 of 2 · One of: document.created, document.issued, document.rejected, document.failed, merchant.created, connection.created, connection.verified, connection.invalid, connection.disconnected, connect_session.completed, webhook_endpoint.disabled, document.retried
enabled_events[]stringrequired: Option 5 of 5 › Option 2 of 2 · Always *

descriptionstring | nullrequired

Your note about the endpoint, or null.

Option 5 of 5

modestringrequired

live for an endpoint made with a live key (live events), test for a test key.

Option 5 of 5 · One of: live, test

statusstringrequired

enabled (events are delivered) or disabled (by you, or by Tallio after failing for days).

Option 5 of 5 · One of: enabled, disabled

disabled_reasonstring | nullrequired

Why Tallio disabled it (failing: it failed every delivery for days); null otherwise.

Option 5 of 5

createdstringrequired

When the endpoint was created.

Option 5 of 5 · Format: date-time

requestobject | nullrequired

The API call that caused the event; null when Tallio caused it, e.g. issuing in the background.

Show nested fields (2)

idstringrequired: Request id (the x-request-id response header) of the API call that caused it.
Show patternHide pattern
^(?:req_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|client:[A-Za-z0-9._:-]{8,128}|[A-Za-z0-9._-]{1,16}::[A-Za-z0-9._:-]{6,110})$
idempotency_keystring | nullrequired: The Idempotency-Key that call sent, or null.
1 to 255 characters
Show patternHide pattern
^[\x21-\x7E]+$

has_morebooleanrequired

Whether more items exist past this page in the direction you paged (starting_after or ending_before).

Example response · 200

{
  "object": "list",
  "data": [],
  "has_more": false
}

Response headers

x-request-idstring: The request's correlation id; quote it when reporting a problem. One of: req_ plus a uuid (Tallio made it), client: plus the x-request-id you sent (8-128 of A-Z a-z 0-9 . _ : -), or the hosting platform's id.
With every response
Show patternHide pattern
^(?:req_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|client:[A-Za-z0-9._:-]{8,128}|[A-Za-z0-9._-]{1,16}::[A-Za-z0-9._:-]{6,110})$
ratelimit-limitinteger: Requests allowed in the current window for the bucket this request counted against.
With 200, 400, 429 · At least 1
ratelimit-remaininginteger: Requests left in the current window; 0 means the next one is refused until the window resets.
With 200, 400, 429 · At least 0
ratelimit-resetinteger: Seconds until the current window resets.
With 200, 400, 429 · At least 0
www-authenticatestring: The bearer challenge: send a vendor secret key as Authorization: Bearer <key>.
With 401 · Always Bearer realm="tallio"
retry-afterinteger: Seconds to wait before retrying a request refused with 429 rate_limited.
With 429 · At least 1

Errors
Code	Status	Retryable	Meaning
`validation_failed`	400	No	Request validation failed.
`unauthorized`	401	No	Authentication is required.
`rate_limited`	429	Yes	A rate limit was reached. Retry later.
`internal_error`	500	No	An unexpected server error occurred.

Retrieve an event #

GET /api/v1/events/{id}

Returns one event of your key's mode, with the snapshot of its object taken when it happened.

Bearer API key

Path parameters

idstringrequired: The event's id (evt_…).

Request

curl

curl -X GET 'https://tallio.dev/api/v1/events/evt_02y9O8rh7F50tGi0QcWRrx' \
  -H "Authorization: Bearer $TALLIO_API_KEY"

TypeScript SDK

import { createTallioClient, unwrap } from "@tallio/sdk";

const tallio = createTallioClient({
  apiKey: process.env.TALLIO_API_KEY!,
  baseUrl: "https://tallio.dev",
});

const result = await unwrap(tallio.http.GET("/api/v1/events/{id}", {
  params: {
    path: {
      id: "evt_02y9O8rh7F50tGi0QcWRrx",
    },
  },
}));

Responses
Status	Description
`200`	The event.
4XX, 5XX	An error: see Errors below.

Response body · 200

dataobjectrequired

Something that happened in your account. Webhooks deliver these; consumers dedupe on id.

Show nested fields (13)

idstringrequired

Id of the event (evt_…).

Show pattern

^evt_[0-9A-Za-z]{22}$

objectstringrequired

Always "event".

Always event

typestringrequired

createdstringrequired

When the event happened.

Format: date-time

api_versionstringrequired

The API version data.object is rendered in, e.g. 0.1.0.

livemodebooleanrequired

True for an event from live mode, false for test mode.

dataanyOfrequired

dataobjectrequired

A document event's data: object is the document right after the event (data.object.object is "document").

Option 1 of 5

Show nested fields (2)

objectobjectrequired

A fiscal document Tallio issues through a provider, with its status and history.

Option 1 of 5

Show nested fields (23)

idstringrequired

Id of the document (doc_…).

Option 1 of 5

Show pattern

^doc_[0-9A-Za-z]{22}$

objectstringrequired

Always "document".

Option 1 of 5 · Always document

merchantstringrequired

Id of the merchant (mer_…).

Option 1 of 5

Show pattern

^mer_[0-9A-Za-z]{22}$

modestringrequired

live for a document created with a live key, test for a test key.

Option 1 of 5 · One of: live, test

providerstringrequired

The licensed e-invoicing provider (or direct myDATA, or Tallio's sandbox) that issues the document.

Option 1 of 5 · One of: sandbox, mydata, wrapp, impact, epsilon, softone, prosvasis

typestringrequired

AADE myDATA document type: 1.1 sales invoice, 2.1 service invoice, 5.1 credit note (associated), 5.2 credit note (non-associated), 11.1 retail sales receipt, 11.2 retail service receipt.

Option 1 of 5 · One of: 1.1, 2.1, 5.1, 5.2, 11.1, 11.2

statusstringrequired

Option 1 of 5 · One of: pending, issued, rejected, failed

stagestring | nullrequired

Where a pending document is (queued, submitting, awaiting_mark, reconciling); null unless status is pending.

Option 1 of 5 · One of: queued, submitting, awaiting_mark, reconciling

issue_datestringrequired

Issue date, YYYY-MM-DD.

Option 1 of 5 · Format: date

currencystringrequired

ISO 4217 currency. Only EUR for now.

Option 1 of 5 · Always EUR

netintegerrequired

Sum of the lines' net amounts, in minor units, at most 1000000000000000.

Option 1 of 5 · From 0 to 1000000000000000

vatintegerrequired

Sum of the lines' VAT, each line rounded half up to the minor unit, in minor units, at most 1000000000000000.

Option 1 of 5 · From 0 to 1000000000000000

grossintegerrequired

net + vat, in minor units, at most 1250000000000000.

Option 1 of 5 · From 0 to 1250000000000000

markstring | nullrequired

MARK (AADE registration number) once issued, as a digit string; null before.

Option 1 of 5

Show pattern

^[1-9]\d{0,18}$

uidstring | nullrequired

myDATA uid: the SHA-1 (40 upper-case hex digits) AADE derives from the document's identifiers; null until known.

Option 1 of 5

Show pattern

^[0-9A-F]{40}$

qr_urlstring | nullrequired

URL the document's QR code points to; null until the provider returns one.

Option 1 of 5 · Format: uri

errorobject | nullrequired

Why the document was rejected or failed; null otherwise.

Option 1 of 5

Show nested fields (6)

codestringrequired: Stable machine-readable error code. Branch on this, never on message.
Option 1 of 5 · One of: validation_failed, unauthorized, not_found, idempotency_conflict, idempotency_in_progress, already_exists, invalid_state, payload_too_large, unsupported_media_type, rate_limited, not_supported, connection_unavailable, provider_credentials_invalid, provider_rejected, provider_unavailable, service_unavailable, internal_error
messagestringrequired: Human-readable explanation, safe to show to a developer.
Option 1 of 5
provider_codestring | nullrequired: The provider's own error code, or null when the error did not come from a provider.
Option 1 of 5
provider_messagestring | nullrequired: The provider's own error message, verbatim, or null when the error did not come from a provider.
Option 1 of 5
retryablebooleanrequired: True when the same request may succeed if sent again later.
Option 1 of 5
provider_rawany: The provider's error response body as received, or a TruncatedProviderRaw marker when it exceeds 4096 bytes of JSON. Never holds request headers, credentials or the request payload.
Option 1 of 5

classificationobjectrequired

How the document was classified for myDATA.

Option 1 of 5

Show nested fields (2)

sourcestringrequired: default when any line took Tallio's default, else override when any line took the merchant's override, else line.
Option 1 of 5 · One of: line, override, default
warningsstring[]required: What to check before issuing, e.g. that defaults were applied.
Option 1 of 5
Each item: Option 1 of 5

external_referencestring | nullrequired

Your own reference for the document, or null.

Option 1 of 5 · Default: null

metadataobjectrequired

Up to 50 key-value pairs of your own (keys up to 40 characters, values up to 500). Do not put personal data in it.

Option 1 of 5 · Default: {}

Show nested fields (1)

{key}string: A value, up to 500 characters.
Option 1 of 5 · 1 to 40 characters

timelineobject[]required

The document's events, oldest first, at most 100.

Option 1 of 5 · Up to 100 items

Each item: One event in a document's history. GET /events/{id} returns the full Event. Option 1 of 5

Show nested fields (3)

idstringrequired: Id of the event (evt_…).
Option 1 of 5
Show patternHide pattern
^evt_[0-9A-Za-z]{22}$
typestringrequired: What happened: document.created (Tallio accepted a document), document.issued (it has a MARK), document.rejected (the provider or AADE refused it), document.failed (Tallio could not deliver it), merchant.created (a merchant was created), connection.created (a merchant was connected to a provider), connection.verified (the provider accepted its credentials), connection.invalid (the provider refused them), connection.disconnected (it was disconnected), connect_session.completed (a merchant connected through a hosted connect link), webhook_endpoint.disabled (Tallio disabled an endpoint failing for days) and document.retried (a failed document was queued to be sent again).
Option 1 of 5 · One of: document.created, document.issued, document.rejected, document.failed, merchant.created, connection.created, connection.verified, connection.invalid, connection.disconnected, connect_session.completed, webhook_endpoint.disabled, document.retried
createdstringrequired: When the event happened.
Option 1 of 5 · Format: date-time

createdstringrequired

When Tallio accepted the document.

Option 1 of 5 · Format: date-time

updatedstringrequired

When the document last changed.

Option 1 of 5 · Format: date-time

previous_attributesobject

The values the changed fields had before the event; absent for an event that changed nothing.

Option 1 of 5

Show nested fields (23)

idstring

Id of the document (doc_…).

Option 1 of 5

Show pattern

^doc_[0-9A-Za-z]{22}$

objectstring

Always "document".

Option 1 of 5 · Always document

merchantstring

Id of the merchant (mer_…).

Option 1 of 5

Show pattern

^mer_[0-9A-Za-z]{22}$

modestring

live for a document created with a live key, test for a test key.

Option 1 of 5 · One of: live, test

providerstring

The licensed e-invoicing provider (or direct myDATA, or Tallio's sandbox) that issues the document.

Option 1 of 5 · One of: sandbox, mydata, wrapp, impact, epsilon, softone, prosvasis

typestring

AADE myDATA document type: 1.1 sales invoice, 2.1 service invoice, 5.1 credit note (associated), 5.2 credit note (non-associated), 11.1 retail sales receipt, 11.2 retail service receipt.

Option 1 of 5 · One of: 1.1, 2.1, 5.1, 5.2, 11.1, 11.2

statusstring

Option 1 of 5 · One of: pending, issued, rejected, failed

stagestring | null

Where a pending document is (queued, submitting, awaiting_mark, reconciling); null unless status is pending.

Option 1 of 5 · One of: queued, submitting, awaiting_mark, reconciling

issue_datestring

Issue date, YYYY-MM-DD.

Option 1 of 5 · Format: date

currencystring

ISO 4217 currency. Only EUR for now.

Option 1 of 5 · Always EUR

netinteger

Sum of the lines' net amounts, in minor units, at most 1000000000000000.

Option 1 of 5 · From 0 to 1000000000000000

vatinteger

Sum of the lines' VAT, each line rounded half up to the minor unit, in minor units, at most 1000000000000000.

Option 1 of 5 · From 0 to 1000000000000000

grossinteger

net + vat, in minor units, at most 1250000000000000.

Option 1 of 5 · From 0 to 1250000000000000

markstring | null

MARK (AADE registration number) once issued, as a digit string; null before.

Option 1 of 5

Show pattern

^[1-9]\d{0,18}$

uidstring | null

myDATA uid: the SHA-1 (40 upper-case hex digits) AADE derives from the document's identifiers; null until known.

Option 1 of 5

Show pattern

^[0-9A-F]{40}$

qr_urlstring | null

URL the document's QR code points to; null until the provider returns one.

Option 1 of 5 · Format: uri

errorobject | null

Why the document was rejected or failed; null otherwise.

Option 1 of 5

Show nested fields (6)

codestringrequired: Stable machine-readable error code. Branch on this, never on message.
Option 1 of 5 · One of: validation_failed, unauthorized, not_found, idempotency_conflict, idempotency_in_progress, already_exists, invalid_state, payload_too_large, unsupported_media_type, rate_limited, not_supported, connection_unavailable, provider_credentials_invalid, provider_rejected, provider_unavailable, service_unavailable, internal_error
messagestringrequired: Human-readable explanation, safe to show to a developer.
Option 1 of 5
provider_codestring | nullrequired: The provider's own error code, or null when the error did not come from a provider.
Option 1 of 5
provider_messagestring | nullrequired: The provider's own error message, verbatim, or null when the error did not come from a provider.
Option 1 of 5
retryablebooleanrequired: True when the same request may succeed if sent again later.
Option 1 of 5
provider_rawany: The provider's error response body as received, or a TruncatedProviderRaw marker when it exceeds 4096 bytes of JSON. Never holds request headers, credentials or the request payload.
Option 1 of 5

classificationobject

How the document was classified for myDATA.

Option 1 of 5

Show nested fields (2)

sourcestringrequired: default when any line took Tallio's default, else override when any line took the merchant's override, else line.
Option 1 of 5 · One of: line, override, default
warningsstring[]required: What to check before issuing, e.g. that defaults were applied.
Option 1 of 5
Each item: Option 1 of 5

external_referencestring | null

Your own reference for the document, or null.

Option 1 of 5

metadataobject

Up to 50 key-value pairs of your own (keys up to 40 characters, values up to 500). Do not put personal data in it.

Option 1 of 5

Show nested fields (1)

{key}string: A value, up to 500 characters.
Option 1 of 5 · 1 to 40 characters

timelineobject[]

The document's events, oldest first, at most 100.

Option 1 of 5 · Up to 100 items

Each item: One event in a document's history. GET /events/{id} returns the full Event. Option 1 of 5

Show nested fields (3)

idstringrequired: Id of the event (evt_…).
Option 1 of 5
Show patternHide pattern
^evt_[0-9A-Za-z]{22}$
typestringrequired: What happened: document.created (Tallio accepted a document), document.issued (it has a MARK), document.rejected (the provider or AADE refused it), document.failed (Tallio could not deliver it), merchant.created (a merchant was created), connection.created (a merchant was connected to a provider), connection.verified (the provider accepted its credentials), connection.invalid (the provider refused them), connection.disconnected (it was disconnected), connect_session.completed (a merchant connected through a hosted connect link), webhook_endpoint.disabled (Tallio disabled an endpoint failing for days) and document.retried (a failed document was queued to be sent again).
Option 1 of 5 · One of: document.created, document.issued, document.rejected, document.failed, merchant.created, connection.created, connection.verified, connection.invalid, connection.disconnected, connect_session.completed, webhook_endpoint.disabled, document.retried
createdstringrequired: When the event happened.
Option 1 of 5 · Format: date-time

createdstring

When Tallio accepted the document.

Option 1 of 5 · Format: date-time

updatedstring

When the document last changed.

Option 1 of 5 · Format: date-time

dataobjectrequired

A merchant event's data: object is the merchant right after the event (data.object.object is "merchant").

Option 2 of 5

Show nested fields (2)

objectobjectrequired

A business that issues documents under your account.

Option 2 of 5

Show nested fields (9)

idstringrequired

Id of the merchant (mer_…).

Option 2 of 5

Show pattern

^mer_[0-9A-Za-z]{22}$

objectstringrequired

Always "merchant".

Option 2 of 5 · Always merchant

external_idstringrequired

Your own id for the merchant, e.g. a shop domain: 1 to 200 characters, trimmed, unique in your account ignoring case (Shop-A and shop-a are the same merchant). Find a merchant by it.

Option 2 of 5 · Up to 200 characters

Show pattern

\S

namestringrequired

The merchant's name, as you show it: 1 to 200 characters, trimmed.

Option 2 of 5 · Up to 200 characters

Show pattern

\S

tax_idstring | nullrequired

The merchant's ΑΦΜ, normalised, or null when not given.

Option 2 of 5

branchintegerrequired

Branch number in the AADE registry; 0 for the head office.

Option 2 of 5 · From 0 to 9007199254740991

metadataobjectrequired

Up to 50 key-value pairs of your own (keys up to 40 characters, values up to 500). Do not put personal data in it.

Option 2 of 5

Show nested fields (1)

{key}string: A value, up to 500 characters.
Option 2 of 5 · 1 to 40 characters

archivedbooleanrequired

True once the merchant is archived; it then issues nothing new.

Option 2 of 5

createdstringrequired

When the merchant was created.

Option 2 of 5 · Format: date-time

previous_attributesobject

The values the changed fields had before the event; absent for an event that changed nothing.

Option 2 of 5

Show nested fields (9)

idstring

Id of the merchant (mer_…).

Option 2 of 5

Show pattern

^mer_[0-9A-Za-z]{22}$

objectstring

Always "merchant".

Option 2 of 5 · Always merchant

external_idstring

Your own id for the merchant, e.g. a shop domain: 1 to 200 characters, trimmed, unique in your account ignoring case (Shop-A and shop-a are the same merchant). Find a merchant by it.

Option 2 of 5 · Up to 200 characters

Show pattern

\S

namestring

The merchant's name, as you show it: 1 to 200 characters, trimmed.

Option 2 of 5 · Up to 200 characters

Show pattern

\S

tax_idstring | null

The merchant's ΑΦΜ, normalised, or null when not given.

Option 2 of 5

branchinteger

Branch number in the AADE registry; 0 for the head office.

Option 2 of 5 · From 0 to 9007199254740991

metadataobject

Up to 50 key-value pairs of your own (keys up to 40 characters, values up to 500). Do not put personal data in it.

Option 2 of 5

Show nested fields (1)

{key}string: A value, up to 500 characters.
Option 2 of 5 · 1 to 40 characters

archivedboolean

True once the merchant is archived; it then issues nothing new.

Option 2 of 5

createdstring

When the merchant was created.

Option 2 of 5 · Format: date-time

dataobjectrequired

A connection event's data: object is the connection right after the event (data.object.object is "connection").

Option 3 of 5

Show nested fields (1)

objectobjectrequired

A merchant's credentials for one provider in one mode. The credentials themselves are never returned.

Option 3 of 5

Show nested fields (9)

idstringrequired

Id of the connection (con_…).

Option 3 of 5

Show pattern

^con_[0-9A-Za-z]{22}$

objectstringrequired

Always "connection".

Option 3 of 5 · Always connection

merchantstringrequired

The merchant this connection belongs to (mer_…).

Option 3 of 5

Show pattern

^mer_[0-9A-Za-z]{22}$

providerstringrequired

The licensed e-invoicing provider (or direct myDATA, or Tallio's sandbox) that issues the document.

Option 3 of 5 · One of: sandbox, mydata, wrapp, impact, epsilon, softone, prosvasis

modestringrequired

live for a connection made with a live key, test for a test key.

Option 3 of 5 · One of: live, test

statusstringrequired

active (documents can be routed to it), invalid (the provider refused its credentials; fix and verify again), disconnected (no longer used; its credentials are deleted 30 days later).

Option 3 of 5 · One of: active, invalid, disconnected

verified_atstring | nullrequired

When the provider last accepted its credentials; null until then.

Option 3 of 5 · Format: date-time

last_errorobject | nullrequired

Why the provider last refused it; null otherwise.

Option 3 of 5

Show nested fields (6)

codestringrequired: Stable machine-readable error code. Branch on this, never on message.
Option 3 of 5 · One of: validation_failed, unauthorized, not_found, idempotency_conflict, idempotency_in_progress, already_exists, invalid_state, payload_too_large, unsupported_media_type, rate_limited, not_supported, connection_unavailable, provider_credentials_invalid, provider_rejected, provider_unavailable, service_unavailable, internal_error
messagestringrequired: Human-readable explanation, safe to show to a developer.
Option 3 of 5
provider_codestring | nullrequired: The provider's own error code, or null when the error did not come from a provider.
Option 3 of 5
provider_messagestring | nullrequired: The provider's own error message, verbatim, or null when the error did not come from a provider.
Option 3 of 5
retryablebooleanrequired: True when the same request may succeed if sent again later.
Option 3 of 5
provider_rawany: The provider's error response body as received, or a TruncatedProviderRaw marker when it exceeds 4096 bytes of JSON. Never holds request headers, credentials or the request payload.
Option 3 of 5

createdstringrequired

When the connection was created.

Option 3 of 5 · Format: date-time

dataobjectrequired

A connect-session event's data: object is the session right after the event (data.object.object is "connect_session"); it never carries the link.

Option 4 of 5

Show nested fields (1)

objectobjectrequired

The connect session right after the event, without its one-time link.

Option 4 of 5

Show nested fields (6)

idstringrequired: Id of the connect session (cs_…).
Option 4 of 5
Show patternHide pattern
^cs_[0-9A-Za-z]{22}$
objectstringrequired: Always "connect_session".
Option 4 of 5 · Always connect_session
merchantstringrequired: The merchant being connected (mer_…).
Option 4 of 5
Show patternHide pattern
^mer_[0-9A-Za-z]{22}$
expires_atstringrequired: When the link stops working: 30 minutes after it was made.
Option 4 of 5 · Format: date-time
completed_atstring | nullrequired: When the merchant connected through it; null until then.
Option 4 of 5 · Format: date-time
connectionstring | nullrequired: The connection the merchant made through it (con_…), or null.
Option 4 of 5
Show patternHide pattern
^con_[0-9A-Za-z]{22}$

dataobjectrequired

A webhook-endpoint event's data: object is the endpoint right after the event (data.object.object is "webhook_endpoint").

Option 5 of 5

Show nested fields (1)

objectobjectrequired

A URL that receives your events, signed with its own secret.

Option 5 of 5

Show nested fields (9)

idstringrequired

Id of the webhook endpoint (we_…).

Option 5 of 5

Show pattern

^we_[0-9A-Za-z]{22}$

objectstringrequired

Always "webhook_endpoint".

Option 5 of 5 · Always webhook_endpoint

urlstringrequired

Where events are POSTed.

Option 5 of 5

enabled_eventsanyOf[]required

The event types delivered, or ["*"].

Option 5 of 5

Show nested fields (3)

enabled_events[]anyOfrequired: An event type to deliver, or * for every type.
Option 5 of 5
enabled_events[]stringrequired: What happened: document.created (Tallio accepted a document), document.issued (it has a MARK), document.rejected (the provider or AADE refused it), document.failed (Tallio could not deliver it), merchant.created (a merchant was created), connection.created (a merchant was connected to a provider), connection.verified (the provider accepted its credentials), connection.invalid (the provider refused them), connection.disconnected (it was disconnected), connect_session.completed (a merchant connected through a hosted connect link), webhook_endpoint.disabled (Tallio disabled an endpoint failing for days) and document.retried (a failed document was queued to be sent again).
Option 5 of 5 › Option 1 of 2 · One of: document.created, document.issued, document.rejected, document.failed, merchant.created, connection.created, connection.verified, connection.invalid, connection.disconnected, connect_session.completed, webhook_endpoint.disabled, document.retried
enabled_events[]stringrequired: Option 5 of 5 › Option 2 of 2 · Always *

descriptionstring | nullrequired

Your note about the endpoint, or null.

Option 5 of 5

modestringrequired

live for an endpoint made with a live key (live events), test for a test key.

Option 5 of 5 · One of: live, test

statusstringrequired

enabled (events are delivered) or disabled (by you, or by Tallio after failing for days).

Option 5 of 5 · One of: enabled, disabled

disabled_reasonstring | nullrequired

Why Tallio disabled it (failing: it failed every delivery for days); null otherwise.

Option 5 of 5

createdstringrequired

When the endpoint was created.

Option 5 of 5 · Format: date-time

requestobject | nullrequired

The API call that caused the event; null when Tallio caused it, e.g. issuing in the background.

Show nested fields (2)

idstringrequired: Request id (the x-request-id response header) of the API call that caused it.
Show patternHide pattern
^(?:req_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|client:[A-Za-z0-9._:-]{8,128}|[A-Za-z0-9._-]{1,16}::[A-Za-z0-9._:-]{6,110})$
idempotency_keystring | nullrequired: The Idempotency-Key that call sent, or null.
1 to 255 characters
Show patternHide pattern
^[\x21-\x7E]+$

Example response · 200

{
  "data": {
    "id": "evt_02y9O8s1a8ymJqpmAy0nLe",
    "object": "event",
    "type": "document.issued",
    "created": "2026-10-11T09:30:02.000Z",
    "api_version": "0.1.0",
    "livemode": false,
    "data": {
      "object": {
        "id": "doc_02y9O8rhJKVUXRvojdffcz",
        "object": "document",
        "merchant": "mer_02y9O8rh7F50tGi0QcWRrx",
        "mode": "test",
        "provider": "sandbox",
        "type": "1.1",
        "status": "issued",
        "stage": null,
        "issue_date": "2026-10-10",
        "currency": "EUR",
        "net": 2500,
        "vat": 435,
        "gross": 2935,
        "mark": "900000000000001",
        "uid": "4E1F0A6C2B9D8E7F6A5B4C3D2E1F0A9B8C7D6E5F",
        "qr_url": "https://sandbox.tallio.invalid/qr/900000000000001",
        "error": null,
        "classification": {
          "source": "default",
          "warnings": [
            "No income classification on line 2; applied the 1.1 default category1_1/E3_561_001. Set it on the line, or as a merchant override, if that is wrong."
          ]
        },
        "external_reference": "#1042",
        "metadata": {
          "order_id": "5520731963508"
        },
        "timeline": [
          {
            "id": "evt_02y9O8rhJ2Z2v1fOH2XiSH",
            "type": "document.created",
            "created": "2026-10-11T09:30:00.000Z"
          },
          {
            "id": "evt_02y9O8s1a8ymJqpmAy0nLe",
            "type": "document.issued",
            "created": "2026-10-11T09:30:02.000Z"
          }
        ],
        "created": "2026-10-11T09:30:00.000Z",
        "updated": "2026-10-11T09:30:02.000Z"
      },
      "previous_attributes": {
        "status": "pending",
        "stage": "awaiting_mark",
        "mark": null,
        "uid": null,
        "qr_url": null,
        "timeline": [
          {
            "id": "evt_02y9O8rhJ2Z2v1fOH2XiSH",
            "type": "document.created",
            "created": "2026-10-11T09:30:00.000Z"
          }
        ],
        "updated": "2026-10-11T09:30:00.000Z"
      }
    },
    "request": null
  }
}

Response headers

x-request-idstring: The request's correlation id; quote it when reporting a problem. One of: req_ plus a uuid (Tallio made it), client: plus the x-request-id you sent (8-128 of A-Z a-z 0-9 . _ : -), or the hosting platform's id.
With every response
Show patternHide pattern
^(?:req_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|client:[A-Za-z0-9._:-]{8,128}|[A-Za-z0-9._-]{1,16}::[A-Za-z0-9._:-]{6,110})$
ratelimit-limitinteger: Requests allowed in the current window for the bucket this request counted against.
With 200, 404, 429 · At least 1
ratelimit-remaininginteger: Requests left in the current window; 0 means the next one is refused until the window resets.
With 200, 404, 429 · At least 0
ratelimit-resetinteger: Seconds until the current window resets.
With 200, 404, 429 · At least 0
www-authenticatestring: The bearer challenge: send a vendor secret key as Authorization: Bearer <key>.
With 401 · Always Bearer realm="tallio"
retry-afterinteger: Seconds to wait before retrying a request refused with 429 rate_limited.
With 429 · At least 1

Errors
Code	Status	Retryable	Meaning
`unauthorized`	401	No	Authentication is required.
`not_found`	404	No	The requested resource was not found.
`rate_limited`	429	Yes	A rate limit was reached. Retry later.
`internal_error`	500	No	An unexpected server error occurred.