> This page is for API.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.spreadspace.app/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.spreadspace.app/_mcp/server.

# document.processed

POST 

Fires once per document, after its extraction has been stored. Carries routing identifiers only, so read the extracted figures back through the API by `document_id`.

Reference: https://docs.spreadspace.app/api/api-reference/webhook-events/webhook-document-processed

## Request

### Headers

- `SpreadSpace-Signature` (string, required) — Signature over the exact request body: `t=<seconds since the Unix epoch>,v1=<lowercase hex HMAC-SHA256 of "{t}.{body}" keyed with your endpoint's signing secret>`. Verify it before trusting the body, and reject a `t` more than five minutes from your own clock. During a secret rotation both the new and the previous secret verify for 24 hours; each delivery is signed with exactly one.
- `SpreadSpace-Event-Id` (string, required) — The event id, identical to the body's `id`. Stable across retries and replays, and shared by every endpoint one event fans out to. Delivery is at-least-once, so dedupe on it.

### Payload

- `id` (string, required) — Event id: `evt_` plus 24 lowercase hex characters. Also sent as the `SpreadSpace-Event-Id` header. Stable across retries and replays, so dedupe on it.
- `type` (enum, required) — Always this event type on this body.
  - Allowed values: `document.processed`
- `created` (long, required) — Seconds since the Unix epoch at which the event was created server-side. Seconds, not milliseconds. Deliveries are not ordered; reconcile on this.
- `tenant_id` (string, required) — The workspace the event belongs to. Reject a delivery whose tenant does not match the endpoint you registered.
- `livemode` (boolean, required) — `true` for live activity, `false` for test mode (an `ss_test_` key or the sandbox simulator). Branch on it to route test deliveries to a staging handler.
- `data` (DocumentProcessedPayload, required) — The `data` object on a `document.processed` delivery, sent once per document once its results have been stored. Identifiers only: no figures and no personal data ever travel in a webhook body. Read the extracted values back through the API with `document_id`.

## Types

### DocumentProcessedPayload

The `data` object on a `document.processed` delivery, sent once per document once its results have been stored. Identifiers only: no figures and no personal data ever travel in a webhook body. Read the extracted values back through the API with `document_id`.

- `document_id` (string, required) — The extracted document, a 24-character identifier.
- `job_id` (string, required) — The document package (job) the document was uploaded in.
- `borrower_id` (string, required) — The borrower that owns the loan.
- `loan_id` (string, required) — The loan the document belongs to.
- `document_type` (string, required) — What the document was classified as, for example `bank_statement`, `w2` or `1120s`.
- `processed_at` (datetime, required) — Server-side wall-clock time the extraction finished and was persisted.
- `extraction_id` (string, optional, nullable) — The extraction record to fetch. Equal to `document_id` today, and null when the document was only classified and no extraction ran. Read it as its own id so a later split of the two does not break you.
- `extraction_version` (integer, optional, nullable) — The revision of the stored extraction at the moment this event fired, 1 for a freshly ingested document. A bank statement can be rewritten shortly after this event, so build on the version `extraction.ready` announces. Null only on events emitted before versioning shipped.