> ## Documentation Index
> Fetch the complete documentation index at: https://docs.didit.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate Business Session PDF

> Download the PDF report of one finished business verification (KYB) session: registry data, key people, owners, documents, AML and reviews.



Generate Business Session PDF API Prompt
        Copy prompt to clipboard



      
      

\<pre>

\`Download the PDF report of one finished Didit business verification (KYB) session.

Endpoint:
GET https://verification.didit.me/v3/organization/{organization_id}/application/{application_id}/businesses/{business_session_id}/pdf/

Authentication:
Use the x-api-key header with my Didit API key. A scoped key needs businesses: read and media: read; a key limited to some workflows or to approved sessions can't call this endpoint. application_id must be the application the key belongs to.

Goal:
\- Store an audit-ready KYB report for my compliance archive, or attach it to a case or regulator request.

Behavior:
\- business_session_id is the session_id of the KYB session.
\- The session must be "Approved", "Declined" or "In Review"; any other status returns 403.
\- The body is binary application/pdf, not JSON. Content-Disposition: attachment; filename=business_<business_session_id>.pdf.
\- The report covers company registry data, key people and beneficial owners, documents, AML results and the other workflow features, plus the session's tags and reviews. With white-label customization on, it uses my logo and privacy policy URL.
\- Rendered on every call: store the file instead of fetching it repeatedly.

Example call:
curl --fail -X GET "https://verification.didit.me/v3/organization/11111111-2222-3333-4444-555555555555/application/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/businesses/c2d3e4f5-0617-4829-9a3b-4c5d6e7f8091/pdf/" \
-H "x-api-key: YOUR_API_KEY" \
\--output business-report.pdf

What to read from the response:
\- The PDF bytes. Do not parse the body as JSON.
\- Content-Disposition - the suggested file name.

Failure modes:
\- 401 - the API key has expired.
\- 403 - {"detail": "You can only generate a PDF for sessions in review, declined or approved."} when the session is not finished; {"detail": "Authentication credentials were not provided or are invalid."} for a missing or invalid key; {"detail": "You do not have permission to perform this action."} for a key of another application; a scoped key without businesses: read or media: read; a key limited to workflows or approved sessions; a request from outside the key's IP list.
\- 404 - {"detail": "Business session not found."}
\- 429 - more than 600 GET requests per minute with this key.

Side effects: none. Not billed.

For the full integration shape, see /integration/integration-prompt.`

\</pre>



      
      

Paste into

[Generate PDF](/sessions-api/generate-pdf.md) also renders KYB reports. Use whichever fits your integration: this endpoint addresses the session through your organization and application, the other one by session ID alone.> [!NOTE]
>
> The report is only available once the session is `Approved`, `Declined` or `In Review`. Wait for the `status.updated` [webhook](/integration/webhooks.md) before you request it.## Related- [Generate PDF](/sessions-api/generate-pdf.md)
- [Export to PDF and CSV](/console/export-pdf-csv.md)
- [KYB response schema](/business-verification/response-schema.md)


## OpenAPI

````yaml GET /v3/organization/{organization_id}/application/{application_id}/businesses/{business_session_id}/pdf/
openapi: 3.0.0
info:
  version: 3.0.0
  title: Didit Verification API
  description: Identity verification API. Authenticate with x-api-key header.
servers:
  - url: https://verification.didit.me
security: []
tags: []
paths:
  /v3/organization/{organization_id}/application/{application_id}/businesses/{business_session_id}/pdf/:
    get:
      tags:
        - Businesses
      summary: Download a business session PDF report
      description: >-
        Render the PDF report of one Business Verification (KYB) session:
        company registry data, key people and beneficial owners, documents, AML
        results and the other workflow features, plus the session's tags and
        review activity. With white-label customization on, the report carries
        your logo and privacy policy URL. The body is the PDF itself
        (`application/pdf`), not JSON.


        The session must be `Approved`, `Declined` or `In Review`; any other
        status returns `403`, so wait for the `status.updated`
        [webhook](https://docs.didit.me/integration/webhooks) first. The report
        is rendered on every call and nothing is billed, so store the file
        instead of fetching it repeatedly. `GET
        /v3/session/{sessionId}/generate-pdf/` renders the same kind of report
        by session ID alone.


        A PDF report counts as media: a scoped API key needs `businesses: read`
        and `media: read`, and a key limited to some workflows or to approved
        sessions cannot call it.
      operationId: get_business_session_pdf
      parameters:
        - name: organization_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
          description: Organization UUID.
          example: 11111111-2222-3333-4444-555555555555
        - name: application_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
          description: >-
            Application UUID. Must be the application the API key belongs to: a
            key used on any other application gets `403`.
          example: aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
        - name: business_session_id
          in: path
          required: true
          description: >-
            `session_id` of the Business Verification (KYB) session, as returned
            when the session was created. A session of another application
            returns `404`.
          schema:
            type: string
            format: uuid
          example: 22222222-3333-4444-5555-666666666666
      responses:
        '200':
          description: The rendered PDF, returned directly as binary `application/pdf`.
          headers:
            Content-Disposition:
              description: >-
                Always `attachment;
                filename=business_{business_session_id}.pdf`.
              schema:
                type: string
                example: >-
                  attachment;
                  filename=business_22222222-3333-4444-5555-666666666666.pdf
          content:
            application/pdf:
              schema:
                type: string
                format: binary
        '401':
          description: >-
            The API key has expired. Only a key created with an expiry date can
            expire; after that date every request with it answers `401`.
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
              examples:
                Expired key:
                  value:
                    detail: This API key has expired.
        '403':
          description: >-
            The request is not allowed or the session is not finished. Read
            `detail`: a session that is not `Approved`, `Declined` or `In
            Review`, a missing or invalid API key (never `401`), an
            `application_id` that is not the key's application, a scoped key
            without `media: read` or `businesses: read`, a key limited to
            workflows or approved sessions, or a request from outside the key's
            IP list.
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
              examples:
                Session not finished:
                  value:
                    detail: >-
                      You can only generate a PDF for sessions in review,
                      declined or approved.
                Missing or invalid key:
                  value:
                    detail: >-
                      Authentication credentials were not provided or are
                      invalid.
                Another application:
                  value:
                    detail: You do not have permission to perform this action.
                Scoped key without media read:
                  value:
                    detail: This API key has no read access to media.
                Scoped key without businesses read:
                  value:
                    detail: This API key has no read access to companies.
                Key limited to workflows or approved sessions:
                  value:
                    detail: >-
                      This API key only reaches sessions inside its workflow or
                      status limits, so it can't use this endpoint.
                Outside the key's IP list:
                  value:
                    detail: This API key can't be used from this IP address.
        '404':
          description: >-
            No business session with this ID exists in the application (never
            created, deleted, or owned by another application). A value that is
            not a UUID returns a `404` HTML page instead of this JSON body.
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
              examples:
                Not found:
                  value:
                    detail: Business session not found.
        '429':
          description: >-
            More than 600 GET requests per minute with this API key. Wait the
            number of seconds in `Retry-After`, then retry.
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
              examples:
                Throttled:
                  value:
                    detail: >-
                      GET request rate limit exceeded. You can make up to 600
                      requests per minute.
          headers:
            Retry-After:
              description: Seconds until the current one-minute window resets.
              schema:
                type: integer
                example: 23
            X-RateLimit-Limit:
              description: Requests allowed per minute in this budget.
              schema:
                type: integer
            X-RateLimit-Remaining:
              description: Requests left in the current window.
              schema:
                type: integer
            X-RateLimit-Reset:
              description: Unix time when the window resets.
              schema:
                type: integer
      security:
        - ApiKeyAuth: []
      x-codeSamples:
        - lang: curl
          label: curl
          source: >-
            curl --fail -X GET
            'https://verification.didit.me/v3/organization/11111111-2222-3333-4444-555555555555/application/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/businesses/22222222-3333-4444-5555-666666666666/pdf/'
            \
              -H 'x-api-key: YOUR_API_KEY' \
              --output business_report.pdf
        - lang: python
          label: Python
          source: |-
            import os

            import requests

            org_id = '11111111-2222-3333-4444-555555555555'
            app_id = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee'
            business_session_id = '22222222-3333-4444-5555-666666666666'
            resp = requests.get(
                f'https://verification.didit.me/v3/organization/{org_id}/application/{app_id}'
                f'/businesses/{business_session_id}/pdf/',
                headers={'x-api-key': os.environ['DIDIT_API_KEY']},
                timeout=60,
            )
            resp.raise_for_status()
            with open(f'business_{business_session_id}.pdf', 'wb') as fh:
                fh.write(resp.content)
        - lang: javascript
          label: JavaScript
          source: >-
            import { writeFile } from 'node:fs/promises';


            const orgId = '11111111-2222-3333-4444-555555555555';

            const appId = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee';

            const businessSessionId = '22222222-3333-4444-5555-666666666666';

            const resp = await fetch(
              `https://verification.didit.me/v3/organization/${orgId}/application/${appId}/businesses/${businessSessionId}/pdf/`,
              { headers: { 'x-api-key': process.env.DIDIT_API_KEY } },
            );

            if (!resp.ok) throw new Error(`PDF generation failed:
            ${resp.status}`);

            await writeFile(`business_${businessSessionId}.pdf`,
            Buffer.from(await resp.arrayBuffer()));
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        Your application's API key, from Developers -> API keys in the Business
        Console. The primary key has full access. A named key can be scoped:
        none, read or write per resource, limited to some workflows or to
        approved sessions, to a list of IP addresses, and to an expiry date. 401
        means the key is missing, wrong, revoked or expired; 403 means the key
        has no access to this resource or action, or the request came from an
        address outside its IP list; 404 on a session route means the session is
        outside the key's workflows or statuses. A key without media access
        receives image, video and PDF URLs as null, and a key without sessions
        write receives session links and tokens as null. See
        https://docs.didit.me/console/api-keys.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.