Developers

API reference

REST and JSON over HTTPS. Every /v1 call takes Authorization: Bearer <api key>. Each tenant gets 600 requests a minute; responses carry X-RateLimit-* headers, and going over returns 429 with Retry-After.

Quick start

Check a report in one call. Issues name the GSE rule (ruleId) and the form field (fieldId) to fix. Severity is error for Fatal findings and warning for Warnings.

curl https://uadengine.com/v1/validate \
  -H "Authorization: Bearer $UAD_API_KEY" \
  -H "Content-Type: application/xml" \
  --data-binary @report.xml

import { readFile } from "node:fs/promises";

const res = await fetch("https://uadengine.com/v1/validate", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.UAD_API_KEY}`,
    "Content-Type": "application/xml",
  },
  body: await readFile("report.xml"),
});
const { valid, issues } = await res.json();

import os, requests

res = requests.post(
    "https://uadengine.com/v1/validate",
    headers={"Authorization": f"Bearer {os.environ['UAD_API_KEY']}",
             "Content-Type": "application/xml"},
    data=open("report.xml", "rb"),
)
print(res.json()["issues"])

Response · 200 OK

{
  "valid": false,
  "issues": [
    {
      "severity": "error",
      "ruleId": "UAD1002",
      "fieldId": "subject.city",
      "message": "Provide the city name for the subject property physical address.",
      "path": "/MESSAGE/.../ADDRESS/CityName"
    }
  ]
}

Compliance checks

Method	Path	What it does
POST	/v1/validate	Stateless check. Send UAD 3.6 XML, get {valid, issues[]} back. Nothing is stored.
POST	/v1/packages/preflight	Check a UCDP delivery package (ZIP: XML + PDF + Images/). Returns SYS9001–SYS9010 findings plus the H-1, H-2 or H-3 findings for the report type.
GET	/v1/rules	The compliance rules with severity, message and whether each is automated. ?report=ValuationUpdate (H-2) or ValuationCompletion (H-3).
GET	/v1/fields	Form fields with labels, sections, value kinds, options, Report Field IDs and A-1 maximum lengths. ?report=update or completion.

Reports

Method	Path	What it does
POST	/v1/reports	Create from JSON {type?, externalRef?, values?} or import an XML body. type is AppraisalReport (URAR), ValuationUpdate or ValuationCompletion.
GET	/v1/reports	List reports.
GET	/v1/reports/:id	{id, type, values, …}
PATCH	/v1/reports/:id	Update field values: {"values": {"subject.city": "Treeville"}}. null clears a field; invalid values are rejected per field.
DELETE	/v1/reports/:id	Delete a report. Its audit log is kept.
PUT	/v1/reports/:id/xml	Replace the report with new XML.
GET	/v1/reports/:id/xml	Download the MISMO 3.6 XML.
POST	/v1/reports/:id/validate	Required fields, structure, the GSE XSD and the compliance rules. Issues carry fieldId and ruleId.
GET	/v1/reports/:id/pdf	The report PDF, laid out to the GSE style guide.
GET	/v1/reports/:id/package	A UCDP delivery package (ZIP) for the report.
PUT	/v1/reports/:id/images/:name	Upload a photo, map or sketch, named as the XML references it under Images/. GET fetches it, DELETE removes it.
GET	/v1/reports/:id/events	The report's audit log, newest first.

Embedding and tenant

Method	Path	What it does
POST	/v1/reports/:id/embed-tokens	Browser-safe token for one report ({ttlSeconds?, readOnly?}).
GET	/v1/tenant	Branding (displayName, logoUrl, primaryColor, fontFamily) and software identity. PATCH to change.
GET	/v1/events	The tenant's whole audit log.
GET	/v1/usage	Usage for a calendar month (?month=2026-11): counts per action plus billable totals.

Embed the form

Mint a token on your server with POST /v1/reports/:id/embed-tokens, then drop the web component into your page. Never put an API key in a page. Theme it with CSS variables on the element: --uad-primary, --uad-font, --uad-radius.

index.html

<script src="https://uadengine.com/embed.js" defer></script>
<uad-form api="https://uadengine.com"
          report="rpt_8f2k…" token="emb_…"></uad-form>

Need a key? Email [email protected]