API + embeds
File upload API with review and expiry
A dumb upload endpoint stores bytes. Holectus also tracks which required files are missing, under review, valid, expiring, or expired — and tells your backend when that changes.
Uploads without owning the bucket
Subjects upload through <DocumentChecklist /> or the HTTP API. Small files proxy through the API; larger files go direct to object storage with a presigned PUT. You do not configure S3 in the embedding app.
Review, expiry, and webhooks
Each file sits in a seven-state lifecycle. Optional approval sends it to<DocumentManager />. Expiry rules mark a slot expiring, then expired. Signed events — document.uploaded, document.expiring,document.expired, validity.changed — land on your backend. Email and SMS stay in your stack.
Gate the next action
POST /api/validity/subjects/:id/assert returns 200 when every in-scope slot is currently valid, or 409 with the slots that are not. Do not copy expiry math into your app.
const res = await fetch(
`${api}/api/validity/subjects/${id}/assert`,
{ method: 'POST', headers: { Authorization: `Bearer ${token}` } },
);
if (res.status === 409) {
// missing, expired, or pending review — do not proceed
}