> ## Documentation Index > Fetch the complete documentation index at: https://docs.tesouro.com/llms.txt > Use this file to discover all available pages before exploring further. # List disclosures ## OpenAPI ````yaml /.tooling/schemas/rest/tags/product-finops.json get /identity/v1/disclosures openapi: 3.1.0 info: title: Tesouro Partner API version: '2026-09-24' description: The Tesouro REST API, for Tesouro partners to integrate with our solution. termsOfService: https://tesouro.com/terms contact: name: Tesouro team url: https://tesouro.com/about/ email: developers@tesouro.com servers: - url: https://api.sandbox.tesouro.com description: Sandbox security: [] tags: - name: Accounting connections - name: Accounting data pull - name: Accounting synchronized records - name: Accounting tax rates - name: Analytics - name: Approval policies - name: Approval requests - name: Bank details - name: Comments - name: Cost centers - name: Counterpart addresses - name: Counterpart bank accounts - name: Counterpart contacts - name: Counterpart VAT IDs - name: Counterparts - name: Credit notes - name: Custom tax rates - name: Delivery notes - name: Departments - name: Disclosures - name: Documents - name: Events - name: Files - name: Ledger accounts - name: Locations - name: Mail templates - name: Mailbox domains - name: Mailboxes - name: Measure units - name: OCR - name: OIDC applications - name: Organizations - name: Overdue reminders - name: Payable duplicates - name: Payable line items - name: Payables - name: Payment intents - name: Payment links - name: Payment methods - name: Payment records - name: Payment reminders - name: Payment terms - name: PDF templates - name: Products - name: Projects - name: Purchase orders - name: Receipts - name: Receivables - name: Recurrences - name: Roles - name: Tags - name: Text templates - name: Transactions - name: Users - name: Webhook deliveries - name: Webhook subscriptions paths: /identity/v1/disclosures: get: tags: - Disclosures summary: List disclosures operationId: GetDisclosures parameters: - name: userId in: query description: >- The invitee. Only meaningful on an application token, and only alongside invitationToken: the id is client-supplied, and the token is what makes it trustworthy. Ignored when a user token identifies the caller. Omit both to be answered for the organization the application token is acting as. schema: type: string format: uuid - name: invitationToken in: query description: |- The invitation token issued to userId. Required alongside it, and omitted when naming nobody. schema: type: string responses: '200': description: >- The version in force, the requirement, whether this caller has accepted it, the documents, and the same for every capacity with a version in force. Acceptance is false when nobody was named. content: text/plain: schema: $ref: '#/components/schemas/DisclosuresResponseDto' application/json: schema: $ref: '#/components/schemas/DisclosuresResponseDto' text/json: schema: $ref: '#/components/schemas/DisclosuresResponseDto' '400': description: >- An application token supplying only one of the user id and the invitation token. content: text/plain: schema: $ref: '#/components/schemas/ProblemDetails' application/json: schema: $ref: '#/components/schemas/ProblemDetails' text/json: schema: $ref: '#/components/schemas/ProblemDetails' '401': description: No token. content: text/plain: schema: $ref: '#/components/schemas/ProblemDetails' application/json: schema: $ref: '#/components/schemas/ProblemDetails' text/json: schema: $ref: '#/components/schemas/ProblemDetails' '403': description: >- The invitation token did not vouch for the given user, that user is no longer invited, or an application token named nobody and carries no organization to answer for. content: text/plain: schema: $ref: '#/components/schemas/ProblemDetails' application/json: schema: $ref: '#/components/schemas/ProblemDetails' text/json: schema: $ref: '#/components/schemas/ProblemDetails' '404': description: The caller could not be resolved to an organization. content: text/plain: schema: $ref: '#/components/schemas/ProblemDetails' application/json: schema: $ref: '#/components/schemas/ProblemDetails' text/json: schema: $ref: '#/components/schemas/ProblemDetails' security: - HTTPBearer: [] components: schemas: DisclosuresResponseDto: required: - version - requirement - accepted - documents type: object properties: accepted: type: boolean description: >- Whether this caller has accepted the version above. False for an invitee by definition, and false again for an existing user after a new version is published. Without it a client cannot tell a cleared user from one owing re-acceptance, and has to prompt everyone or nobody. capacities: type: array items: $ref: '#/components/schemas/DisclosureCapacityStateDto' description: >- Every capacity with a version in force, whether or not it falls on this caller, so a client can list what governs the organization. The fields above describe the person capacity alone. Whether an entry is this caller's to act on is carried by its standing and canAccept, never by being absent. documents: type: array items: $ref: '#/components/schemas/DisclosureDocumentDto' description: The documents making up the version, in the order to present them. requirement: $ref: '#/components/schemas/DisclosureRequirement' description: Whether this caller's organization requires disclosures at all. version: type: - 'null' - string description: >- The version in force, or null if the caller's bank has published none. Submit this back when accepting, so an acceptance cannot be recorded against documents that were superseded while the caller was reading them. format: uuid description: >- The disclosures in force for a caller, and whether they have accepted them. ProblemDetails: type: object properties: detail: type: - 'null' - string instance: type: - 'null' - string status: pattern: ^-?(?:0|[1-9]\d*)$ type: - 'null' - integer - string format: int32 title: type: - 'null' - string type: type: - 'null' - string DisclosureCapacityStateDto: required: - capacity - version - documents - accepted - canAccept - standing type: object properties: accepted: type: boolean description: >- Whether the obligation is met. On the entity capacity this is the organization's execution, so it can be true for a caller who did nothing themselves. canAccept: type: boolean description: >- Whether this caller can discharge it through the acceptance endpoint. The entity and signer capacities are a designated signer's alone, and every capacity is false throughout a read made on an invitee's behalf, since that endpoint refuses a request carrying no user claim. capacity: $ref: '#/components/schemas/DisclosureCapacity' documents: type: array items: $ref: '#/components/schemas/DisclosureDocumentDto' description: The documents making up that version, in the order to present them. graceDeadlineTsUtc: type: - 'null' - string description: >- When an unmet entity obligation stops being tolerated. Null on the capacities with no grace, and null once it is met. format: date-time standing: $ref: '#/components/schemas/DisclosureStanding' description: >- Clear, owed with time left, or owed with the consequence applying now. version: type: string description: >- The version in force in this stream. Submit it back when accepting, so an acceptance cannot be recorded against documents superseded while the caller was reading. format: uuid description: One capacity's obligation and where it leaves the caller. DisclosureDocumentDto: required: - title - url type: object properties: title: type: string description: Display name, as it should be shown to the user. url: type: string description: Where the document is hosted. This service does not serve the file. description: One document the caller is being asked to accept. DisclosureRequirement: enum: - NOT_REQUIRED - REQUIRED type: string DisclosureCapacity: enum: - ENTITY - SIGNER - PERSON type: string description: >- The capacity a disclosure version addresses. Each capacity is an independent version stream per bank organization, so a bank can have up to one version in force per capacity at a time, and publishing into one stream leaves the others untouched. DisclosureStanding: enum: - CLEAR - IN_GRACE - EXPIRED type: string description: >- Where a caller stands against one capacity's obligation. Three states rather than a boolean because an unmet entity obligation runs a grace period before it restricts anything. securitySchemes: HTTPBearer: type: http scheme: bearer ````