> ## Documentation Index > Fetch the complete documentation index at: https://docs.trycactus.com/llms.txt > Use this file to discover all available pages before exploring further. # Keep an authorized viewer's report session open > Call from your backend after revalidating the signed-in customer's access. Extends an already redeemed session for another 15 minutes without replacing its token or reloading the iframe. Renew every 5 minutes and when the host tab resumes. May resume an expired session, but never a revoked one. Unredeemed launch tickets cannot be renewed. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/underwritings/{underwriting_id}/embed-sessions/{session_id}/renew openapi: 3.1.0 info: title: Cactus Partner API version: 1.0.0-draft.1 summary: Document extraction and automated underwriting for CRE. description: | # Overview The Cactus Partner API provides two products: - **Extraction** — upload commercial real estate documents (offering memoranda, rent rolls, T-12 / operating statements, and other business documents) and receive structured, validated JSON with per-field confidence. - **Underwriting** — provide a property address, asset class, and notification email (documents optional) to run a full automated underwriting; results are delivered as a hosted financial-analysis report link plus a machine-readable summary. ## Authentication Every request carries an API key: `Authorization: Bearer ck_live_...` (or `ck_sandbox_...`). Keys are issued by Cactus at kickoff and can be rotated or revoked at any time. ## Products and access Accounts are enabled per product, so not every endpoint below is available to every account: | Product | Endpoints | | --- | --- | | Extraction | `/v1/extractions` | | Underwriting | `/v1/underwritings` | | Usage reporting | `/v1/usage` | `/v1/documents` and `/v1/webhook-endpoints` are available to every account — uploads and webhook delivery underpin both products. Calling an endpoint your account is not enabled for returns `403` with code `product_not_enabled`; contact api@trycactus.com to add a product. A `403` with code `missing_scope` means the account *is* enabled but this particular key was issued without that scope — use a key that carries it. The MCP server advertises only the tools your key can use, so the same rules apply there. ## Sandbox `ck_sandbox_` keys hit the same endpoints but never debit your usage pool: uploads are accepted, and jobs return deterministic fixture output within seconds. Use sandbox keys for integration development and CI. Registering a sandbox document under a documented example filename (e.g. `example-rent-roll-1.xlsx`) returns the real extracted output of that reference document — see the Sandbox guide for the full list. ## Asynchronous jobs Extractions and underwritings are asynchronous. Create the job (`202 Accepted`), then either poll the job resource or register a webhook endpoint to receive signed events (recommended). Typical extraction turnaround is minutes. ## Billing semantics A document is **accepted** when it passes validation (size caps, page/row counts, type resolution). Acceptance debits your usage pool at the fixed rate-card price for the document type — before processing, so pricing is deterministic. Rejected documents are never charged. Documents exceeding their type's size cap bill as multiple units of the same type; the accept response discloses `billed.units`. Files over 500 pages or 100 MB are rejected outright. ## Idempotency All `POST` endpoints accept an `Idempotency-Key` header (any unique string, e.g. a UUID). Retrying a request with the same key returns the original response instead of creating a duplicate. ## Errors Errors follow RFC 9457 (`application/problem+json`) and always include a stable machine-readable `code` and the `request_id` to quote in support requests. ## Versioning The path major version (`/v1`) changes only for breaking API changes. Extraction output schemas are versioned independently per document type (e.g. `rent_roll.v1`) and declared in every result; breaking output changes ship as a new schema version with advance notice and an overlap window. --- All field-level output schemas — `RentRollData` (`rent_roll.v1`), `T12Data` (`t12.v1`), `OfferingMemorandumData` (`offering_memorandum.v1`), and `GenericDocumentData` (`facts.v1`) — are finalized against the extraction engine's real output. contact: name: Cactus API Support email: api@trycactus.com license: name: Proprietary — Cactus API License Agreement identifier: LicenseRef-Cactus-Partner-Agreement servers: - url: https://api.trycactus.com description: Production (live and sandbox keys) security: - apiKey: [] tags: - name: Documents description: Upload and manage documents via presigned URLs. - name: Extractions description: Structured data extraction jobs and results. - name: Underwritings description: Automated underwriting runs. - name: Usage description: Usage pool balance and metered activity. - name: Webhook Endpoints description: Manage endpoints that receive signed event notifications. paths: /v1/underwritings/{underwriting_id}/embed-sessions/{session_id}/renew: post: tags: - Underwritings summary: Keep an authorized viewer's report session open description: > Call from your backend after revalidating the signed-in customer's access. Extends an already redeemed session for another 15 minutes without replacing its token or reloading the iframe. Renew every 5 minutes and when the host tab resumes. May resume an expired session, but never a revoked one. Unredeemed launch tickets cannot be renewed. operationId: renewUnderwritingEmbedSession parameters: - name: underwriting_id in: path required: true schema: type: string - name: session_id in: path required: true schema: type: string requestBody: required: true content: application/json: schema: type: object additionalProperties: false required: - end_user_ref - parent_origin properties: end_user_ref: type: string minLength: 1 maxLength: 255 parent_origin: type: string minLength: 1 maxLength: 512 responses: '200': description: Session extended. No new URL or token is issued. content: application/json: schema: type: object required: - id - expires_at properties: id: type: string expires_at: type: string format: date-time '400': description: Invalid request '401': description: Invalid API key or session authority removed '403': description: Missing scope '404': description: >- Session does not match partner, customer, underwriting, or parent origin '409': description: Launch ticket has not been exchanged components: securitySchemes: apiKey: type: http scheme: bearer bearerFormat: ck_live_* or ck_sandbox_* description: Partner API key issued by Cactus. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.