> ## Documentation Index > Fetch the complete documentation index at: https://docs.didit.me/llms.txt > Use this file to discover all available pages before exploring further. # Update Document AI Data > Correct the fields Didit extracted from a Document AI document, or set its review status, on a KYC or KYB verification session. Update Document AI Data API Prompt Copy prompt to clipboard \

\`Correct the extracted data of a Document AI document, or set its review status, on a Didit verification session through the API.

Endpoint:
PATCH https://verification.didit.me/v3/document-ai/{session_id}/documents/{document_uuid}/

Authentication:
Send my Didit API key in the x-api-key header. A scoped key needs decisions: write.

Goal:
\- Fix a value Document AI misread, or approve or decline a document the workflow sent to review.

Request body (JSON, both fields optional):
\- extracted_data: a JSON object of field keys to new values. Merged key by key: sent keys replace the stored values (a null value clears one), keys I leave out keep their values. Do not send extracted_data itself as null (400); leave it out instead.
\- status: "Approved", "Declined", "In Review" or "Not Finished".

Behavior:
\- Works for user (KYC) and business (KYB) session IDs.
\- {document_uuid} is document_ai_documents[].items[].uuid from GET /v3/session/{session_id}/decision/, and the document must belong to that session.
\- The document status feeds the Document AI result of its workflow node in the decision. The session status is not recomputed.
\- Every successful call, even one that changes nothing, sends a data.updated webhook with trigger "manual_review".

Example call:
curl -X PATCH "https://verification.didit.me/v3/document-ai/11111111-2222-3333-4444-555555555555/documents/44444444-5555-6666-7777-888888888888/" \
-H "x-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"extracted_data": {"invoice_number": "INV-2026-0042"}, "status": "Approved"}'

What to read from the response:
\- extracted_data: all extracted fields after the merge.
\- status: the document's review status.
\- file_url: the storage path of the file, not a download link. Read the presigned file_url from the session decision to download it.

Failure modes:
\- 400: status is not one of the allowed values, or extracted_data is null (checked before the document is looked up).
\- 401: the API key has expired.
\- 403: missing or invalid key, a key of another application, a scoped key without decisions: write, or a request from outside the key's IP allowlist.
\- 404: the session does not exist, was deleted, or is outside a scoped key's limits, or the document does not belong to the session.

Side effects: updates the document and sends a data.updated webhook.

For the full integration shape, see /integration/integration-prompt.`

\
Paste into The field keys are the ones you configured for the document in the workflow. See [Document AI](/core-technology/document-ai/overview.md) for how documents and fields are set up, and the [Document AI report](/core-technology/document-ai/report-document-ai.md) for where the result appears in the session decision. ## OpenAPI ````yaml PATCH /v3/document-ai/{sessionId}/documents/{documentUuid}/ openapi: 3.0.0 info: version: 3.0.0 title: Didit Verification API description: Identity verification API. Authenticate with x-api-key header. servers: - url: https://verification.didit.me security: [] tags: [] paths: /v3/document-ai/{sessionId}/documents/{documentUuid}/: patch: tags: - Sessions summary: Update a Document AI document description: >- Correct the fields Document AI extracted from one uploaded document, set its review status, or both, on a KYC or KYB session. `extracted_data` must be a JSON object and is merged key by key: a key you send replaces the stored value (a key sent as `null` is stored as `null`) and keys you leave out keep their values. The document status feeds the Document AI result of its workflow node in the session decision; the session status itself is not recomputed. Every successful call, including one that changes nothing, sends a `data.updated` [webhook](https://docs.didit.me/integration/webhooks) with trigger `manual_review`. A scoped API key needs `decisions: write`; see [Document AI](https://docs.didit.me/core-technology/document-ai/overview). operationId: patch_v3_document_ai_document parameters: - name: sessionId in: path required: true description: >- UUID of the verification session (the `session_id` returned by `POST /v3/session/`). Accepts both User Verification (KYC) and Business Verification (KYB) session IDs: the server resolves the ID across both session types. Must be a well-formed UUID; a malformed value does not match the route and returns an HTML `404`. schema: type: string format: uuid example: 11111111-2222-3333-4444-555555555555 - name: documentUuid in: path required: true description: >- UUID of the Document AI document (`document_ai_documents[].items[].uuid` in `GET /v3/session/{sessionId}/decision/`). It must belong to the session in the path. schema: type: string format: uuid example: 44444444-5555-6666-7777-888888888888 requestBody: required: true content: application/json: schema: type: object properties: extracted_data: type: object additionalProperties: true description: >- Field keys (the keys you configured for the document) and their corrected values. Must be a JSON object; merged key by key into the stored data. Leave it out rather than sending `null`, which returns `400`. example: invoice_number: INV-2026-0042 status: type: string enum: - Approved - Declined - In Review - Not Finished description: New review status of the document. example: Approved example: extracted_data: invoice_number: INV-2026-0042 status: Approved responses: '200': description: Document updated. Returns the document after the merge. content: application/json: schema: type: object required: - uuid - document_key - original_filename - file_url - status - extracted_data properties: uuid: type: string format: uuid description: Document identifier. document_key: type: string description: The configured document this upload corresponds to. original_filename: type: string nullable: true description: File name the document was uploaded with. file_url: type: string nullable: true description: >- Storage path of the uploaded file. It is not a download link: read the presigned `file_url` from the session decision to download the file. status: type: string enum: - Not Finished - Approved - Declined - In Review - Resub Requested description: Review status of the document. extracted_data: type: object nullable: true additionalProperties: true description: All extracted fields after the merge, keyed by field key. example: uuid: 44444444-5555-6666-7777-888888888888 document_key: invoice original_filename: invoice-2026-09.pdf file_url: >- document_ai/11111111-2222-3333-4444-555555555555-66666666-7777-8888-9999-000000000000.pdf status: Approved extracted_data: invoice_number: INV-2026-0042 total_amount: 1250 issue_date: '2026-09-01' '400': description: >- Validation error, checked before the document is looked up: `status` not one of the allowed values, or `extracted_data` sent as `null`. content: application/json: examples: Invalid status: summary: status not in the enum value: status: - '"Rejected" is not a valid choice.' Null extracted_data: summary: extracted_data is null value: extracted_data: - This field may not be null. '401': description: >- The scoped API key has expired. This is the only case that returns `401`: a missing, invalid or revoked key returns `403`. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Expired key: summary: The key's expiry date has passed value: detail: This API key has expired. '403': description: >- Authentication or authorization failure. Missing, invalid and revoked keys return `403` (not `401`); so do a key of another application, a scoped key without the permission this endpoint needs, and a request from outside the key's IP allowlist. Distinguish them by `detail`. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Missing or invalid credentials: summary: No x-api-key header, or the key failed validation value: detail: >- Authentication credentials were not provided or are invalid. Other application: summary: >- A valid key that belongs to a different application than the session value: detail: You do not have permission to perform this action. Scoped key without decisions write: summary: 'Scoped key lacks decisions: write' value: detail: This API key has no write access to decisions. IP not allowed: summary: Request from outside the key's IP allowlist value: detail: This API key can't be used from this IP address. '404': description: >- The session does not exist, was deleted or is outside a scoped key's limits, or no current document with this UUID belongs to it. The session lookup runs before the credential check, so an unknown `sessionId` returns `404` even without a valid key. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Unknown session: summary: No session with this ID exists, or it was deleted value: detail: Not found. Outside key limits: summary: >- The session is outside a scoped key's limits (also returned for a session deleted moments ago) value: detail: Session not found. Unknown document: summary: documentUuid does not belong to the session value: detail: Document AI document not found. '429': description: >- Rate limit exceeded: 300 write (POST, PATCH, DELETE) requests per minute per API key. Wait `Retry-After` seconds before retrying; the `X-RateLimit-*` headers show the budget. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Rate limited: summary: Budget for the current minute exhausted value: detail: >- Write request rate limit exceeded. You can make up to 300 requests per minute. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 1 example: 30 security: - ApiKeyAuth: [] x-codeSamples: - lang: curl label: curl source: >- curl -X PATCH 'https://verification.didit.me/v3/document-ai/11111111-2222-3333-4444-555555555555/documents/44444444-5555-6666-7777-888888888888/' \ -H 'x-api-key: YOUR_API_KEY' \ -H 'Content-Type: application/json' \ -d '{"extracted_data": {"invoice_number": "INV-2026-0042"}, "status": "Approved"}' - lang: python label: Python source: |- import os import requests session_id = '11111111-2222-3333-4444-555555555555' document_uuid = '44444444-5555-6666-7777-888888888888' resp = requests.patch( f'https://verification.didit.me/v3/document-ai/{session_id}/documents/{document_uuid}/', headers={'x-api-key': os.environ['DIDIT_API_KEY']}, json={'extracted_data': {'invoice_number': 'INV-2026-0042'}, 'status': 'Approved'}, timeout=10, ) resp.raise_for_status() document = resp.json() print(document['status'], document['extracted_data']) - lang: javascript label: JavaScript source: >- const sessionId = '11111111-2222-3333-4444-555555555555'; const documentUuid = '44444444-5555-6666-7777-888888888888'; const resp = await fetch(`https://verification.didit.me/v3/document-ai/${sessionId}/documents/${documentUuid}/`, { method: 'PATCH', headers: { 'x-api-key': process.env.DIDIT_API_KEY, 'Content-Type': 'application/json' }, body: JSON.stringify({ extracted_data: { invoice_number: 'INV-2026-0042' }, status: 'Approved' }), }); if (!resp.ok) throw new Error(`Update failed: ${resp.status}`); const document = await resp.json(); console.log(document.status, document.extracted_data); components: securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.