# e-Próspera API > Public API and CLI for Próspera's resident registry, legal-entity incorporation, partner-managed natural-person residency, OAuth identity, and agent-delegated workflows. Base URL: https://portal.eprospera.com (production), https://stg.portal.eprospera.com (staging; legacy hostname transition is documented in /testing-in-staging). The API ships from the same origin as the consumer portal. There is no separate api.eprospera.com host. Prefer the official CLI when a shell command is available; use direct HTTP for custom clients, OAuth flows, and endpoints the CLI does not cover. Credential types: standard API keys (sk-…) for first-party use, Agent Keys (ak-…) for scope-checked delegation, Partner Keys (pk-…) for approved organization-scoped natural-person onboarding, and OAuth 2.0 / OIDC access tokens for end-user consent flows. Conventions (errors, status codes, timestamps, pagination, rate limits) are documented once in /conventions and apply to every endpoint. Machine-readable spec: https://docs.eprospera.com/openapi.yaml (also /openapi.json). Every page below is also available as raw markdown by appending `.md` to its URL. ## Docs - [Agent Keys](https://docs.eprospera.com/agent-keys): Agent Keys let an e-resident delegate specific API capabilities to an AI agent, CLI workflow, or third-party service without sharing their personal standard API key. - [Agent recipes](https://docs.eprospera.com/agent-recipes): End-to-end API key and OAuth workflows you can copy, paste, and run. The CLI path is recommended when your runtime can execute shell commands; direct HTTP examples are included for custom clients and environments where the CLI is not available. - [Catalyst Program](https://docs.eprospera.com/catalyst-program): e-Próspera's referral system: attribute residency and entity signups to your referral code and track referrals via the API. - [e-Próspera CLI](https://docs.eprospera.com/cli): The official CLI wraps the public API in commands that are easier for humans, scripts, CI jobs, and AI agents to call safely. Use it when your runtime can execute shell commands. Use direct HTTP only when you are building your own client, need an endpoint the CLI does not cover, or cannot install Node tooling. - [Conventions](https://docs.eprospera.com/conventions): Shared rules that apply across every endpoint of the e-Próspera API. Most reference pages link here instead of restating these conventions. - [Amendments and certificates](https://docs.eprospera.com/entity-filings): Prepare entity amendments, complete representative signing and payment, track review, and retrieve certificates and applicant documents. - [Getting started](https://docs.eprospera.com/getting-started): Choose an API key or OAuth, then send your first request through the CLI or direct HTTP. - [Incorporating an entity](https://docs.eprospera.com/incorporating-entity): This guide walks through the CLI and direct API flow for incorporating an LLC in Próspera. - [Firebase Authentication integration](https://docs.eprospera.com/oauth-firebase): Connect Firebase Authentication to e-Próspera as an OpenID Connect provider. - [NextAuth.js integration](https://docs.eprospera.com/oauth-nextauth): Use Auth.js / NextAuth with e-Próspera as a custom OIDC provider. - [OAuth 2.0 / OpenID Connect](https://docs.eprospera.com/oauth-overview): e-Próspera provides an OAuth 2.0 and OpenID Connect authorization server so third-party applications can authenticate users and access their data with consent. - [Embedded agreement and identity verification](https://docs.eprospera.com/partner-embed): Host the Agreement of Coexistence and Veriff identity verification inside your own page with a PKCE-bound e-Próspera iframe. Origins, activation, events, expiry, errors, and troubleshooting. - [Partner Keys](https://docs.eprospera.com/partner-keys): Partner Keys let an approved organization create and manage natural-person residency applications over REST. Each `pk-...` key belongs to one Partner Integration and can access only that integration's applications. - [Partner onboarding](https://docs.eprospera.com/partner-onboarding): How an approved organization is provisioned for the Partner API: what to send e-Próspera, how origins and keys work, what to test before production, and how to report problems. - [Personal and applicant documents](https://docs.eprospera.com/personal-and-applicant-documents): Retrieve a person's own documents or your integration's applicant agreements, distinguish acceptance from signed PDFs, and handle missing or delayed documents. - [Quarterly VAT filing](https://docs.eprospera.com/quarterly-vat): See how an app can help someone choose a taxpayer, prepare a quarterly VAT filing, check the amount due, and submit it with their permission. - [Skills for AI Agents](https://docs.eprospera.com/skills-for-agents): A CLI-first capability map and decision tree for LLM-based callers. **Read this before making your first request** — it is shorter than the reference docs and will save you from probing endpoints that are empty by design. - [Standard API Keys](https://docs.eprospera.com/standard-keys): Standard API keys (`sk-`) are the first-party credential for your own backend, CLI, and personal automation. They are unscoped: they act as you on every standard-key route, including registry lookups, owned entity records, incorporation, hosted checkout, and referral attribution. - [Tax and legal-entity data](https://docs.eprospera.com/tax-and-entity-data): See which tax filings are due, review past returns, download tax documents, and access information about businesses you represent, with your permission. - [Testing in staging](https://docs.eprospera.com/testing-in-staging): Use separate staging accounts and credentials to test e-Próspera API, OAuth, and payments. Voucher API1234 covers every product; Stripe test card ACCT-000015. - [Docs releases section](https://docs.eprospera.com/releases/docs-releases-section): 2026-07-27 · News — API changes and product updates now publish under Releases. - [e-Próspera CLI v0.3.0](https://docs.eprospera.com/releases/eprospera-cli-0-3-0): 2026-08-12 · News — OAuth login, consented legal-entity reads, and read-only tax commands are now available in the official CLI. - [Releases](https://docs.eprospera.com/releases): API changes and product news for partners integrating with e-Próspera. - [OAuth device authorization and tax reads](https://docs.eprospera.com/releases/oauth-device-and-tax-api): 2026-08-12 · API — Additive OAuth endpoints and scopes now support the official CLI, consented entities, and read-only tax data. - [Partner embed and onboarding guides](https://docs.eprospera.com/releases/partner-embed-and-onboarding-docs): 2026-09-15 · News — New guides for the embedded agreement and identity-verification iframe, partner provisioning, and staging behavior; expanded Partner Key error and payment contracts. - [Operate as an AI agent for a resident](https://docs.eprospera.com/use-cases/ai-agents): Act on a resident's behalf with a scoped Agent Key — from read-only lookups to zero-browser LLC incorporation under a Manifestation of Will. - [Register event visitors with zero credentials](https://docs.eprospera.com/use-cases/event-visitor-passes): Submit visitor-pass applications from your event site, coworking space, or tourism platform — no API key required. - [Incorporate LLCs as a formation platform](https://docs.eprospera.com/use-cases/incorporation-platform): Create Próspera LLC applications, take payment, poll to approval, and deliver the entity documents — end to end over the API. - [Onboard residents as a relocation partner](https://docs.eprospera.com/use-cases/residency-partner): Submit and manage natural-person residency applications for your clients with a Partner Key — drafts, documents, payment, and submission. - [Add "Sign in with e-Próspera" to your app](https://docs.eprospera.com/use-cases/sign-in-with-eprospera): Authenticate users with OAuth 2.0 / OpenID Connect and, with their consent, read verified residency and entity data. - [Verify residents and entities as a compliance vendor](https://docs.eprospera.com/use-cases/verify-residents): Confirm Resident Permit Numbers and look up registry records in real time for KYC, AML, and background-check workflows. - [Official CLI](https://github.com/Honduras-Prospera-inc/eprospera-cli): Source repository for the e-Próspera CLI. ## REST API reference - [Verify whether an RPN exists and is active](https://docs.eprospera.com/reference/post-verify-rpn): Look up a Resident Permit Number and report whether it belongs to a legal entity, a natural person, or is unknown — and whether the resident currently has an active residency. Rate-limited to 5,000 requests per 24 hours and 50 per minute, per API key. Exceeding either bound returns `429`. Accepts standard API keys (`sk-`) and Agent Keys (`ak-`) holding the `agent:verify_rpn` scope. - [Search the legal-entity registry](https://docs.eprospera.com/reference/post-search-entities): Performs a case-insensitive name search and partial RPN match. Accepts standard and appropriately scoped Agent Keys. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Check legal-entity name availability](https://docs.eprospera.com/reference/post-legal-entity-name-availability): Checks for an existing registered name using the same case-insensitive exact-name and entity-option rule as incorporation. Send the name without its legal extension and an optionId (for example llc). Accepts a Standard Key or an Agent Key with agent:registry.search. This read-only check does not reserve a name or guarantee approval; drafts are not reservations, and the check is repeated during incorporation. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Get a legal entity](https://docs.eprospera.com/reference/get-legal-entities-id): Returns entity identifiers, registration and residency status, jurisdiction, principal office, and the current registered agent with office and mailing addresses. Requires current representation; Agent Keys are additionally restricted to entities created through the Agent API. The UUID id and 14-digit residentPermitNumber are distinct identifiers; no separate registration number is issued by this endpoint. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [List documents for a legal entity](https://docs.eprospera.com/reference/get-legal-entities-id-documents): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [List amendment filings for a legal entity](https://docs.eprospera.com/reference/get-legal-entities-id-amendments): Returns every amendment filing (name and principal office changes) for the entity, newest first. Standard keys act on every entity the key owner actively represents. Agent Keys are limited to entities incorporated through the API and need active representation and the listed `agent:entity.filing.*` scope. Agent writes also require an active Manifestation of Will. OAuth tokens and Partner Keys cannot call these filing endpoints. See https://docs.eprospera.com/entity-filings for signing, payment, and recovery. Agent scope: `agent:entity.filing.read`. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Create an amendment filing](https://docs.eprospera.com/reference/post-legal-entities-id-amendments): Creates the entity's open amendment draft, or reuses the existing Draft, and replaces all proposals; omitted fields are cleared. The response includes `nextSteps.signatureUrl`: an active representative must sign the amendment in the portal before it can be paid. Returns 409 with code invalid_principal_office when a PES customer proposes an address other than the PES office. Returns 409 while another amendment is pending review or a signed filing is awaiting payment. Standard keys act on every entity the key owner actively represents. Agent Keys are limited to entities incorporated through the API and need active representation and the listed `agent:entity.filing.*` scope. Agent writes also require an active Manifestation of Will. OAuth tokens and Partner Keys cannot call these filing endpoints. See https://docs.eprospera.com/entity-filings for signing, payment, and recovery. Agent scope: `agent:entity.filing.create`. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Get an amendment filing](https://docs.eprospera.com/reference/get-legal-entities-id-amendments-filing-id): Poll this endpoint after submission; terminal states are `Approved` and `Rejected`. Approved amendments add a Certificate of Amendment to the entity documents. Standard keys act on every entity the key owner actively represents. Agent Keys are limited to entities incorporated through the API and need active representation and the listed `agent:entity.filing.*` scope. Agent writes also require an active Manifestation of Will. OAuth tokens and Partner Keys cannot call these filing endpoints. See https://docs.eprospera.com/entity-filings for signing, payment, and recovery. Agent scope: `agent:entity.filing.read`. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Update proposed changes on a Draft amendment](https://docs.eprospera.com/reference/patch-legal-entities-id-amendments-filing-id): Only `Draft` filings can be changed. Omitted fields are preserved; null clears a proposal. A revision invalidates the previous signature. PES customers must retain the PES office address; other address proposals return 409 with code invalid_principal_office. Invoiced and submitted filings are read-only. Standard keys act on every entity the key owner actively represents. Agent Keys are limited to entities incorporated through the API and need active representation and the listed `agent:entity.filing.*` scope. Agent writes also require an active Manifestation of Will. OAuth tokens and Partner Keys cannot call these filing endpoints. See https://docs.eprospera.com/entity-filings for signing, payment, and recovery. Agent scope: `agent:entity.filing.create`. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Pay an amendment filing with a voucher](https://docs.eprospera.com/reference/post-legal-entities-id-amendments-filing-id-pay-voucher): The filing must be signed first (see `nextSteps.signatureUrl`). Creates the filing invoice when needed, applies the voucher, and submits the amendment for review when the voucher covers the full amount. Invoice preparation happens before voucher validation, so an invalid voucher can leave a locked Pending Payment filing with an unpaid invoice. Read state before retrying after errors/timeouts. Standard keys act on every entity the key owner actively represents. Agent Keys are limited to entities incorporated through the API and need active representation and the listed `agent:entity.filing.*` scope. Agent writes also require an active Manifestation of Will. OAuth tokens and Partner Keys cannot call these filing endpoints. See https://docs.eprospera.com/entity-filings for signing, payment, and recovery. Agent scope: `agent:entity.filing.pay`. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Submit a paid amendment filing for review](https://docs.eprospera.com/reference/post-legal-entities-id-amendments-filing-id-submit): Use when the invoice was paid outside the voucher endpoint, for example by card in the portal. For the first submission, require `nextSteps.submitReady === true`: a signed, paid, unsubmitted filing in `Pending Payment`. Repeating a submission returns its current state; a pending dispatch is retried without changing the original submission time. Standard keys act on every entity the key owner actively represents. Agent Keys are limited to entities incorporated through the API and need active representation and the listed `agent:entity.filing.*` scope. Agent writes also require an active Manifestation of Will. OAuth tokens and Partner Keys cannot call these filing endpoints. See https://docs.eprospera.com/entity-filings for signing, payment, and recovery. Agent scope: `agent:entity.filing.pay`. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [List Certificate of Good Standing requests](https://docs.eprospera.com/reference/get-legal-entities-id-certificate-requests): Returns the entity's certificate requests, newest first, plus current eligibility. Only LLCs and for-profit corporations with an active residency and no dissolution are eligible. Standard keys act on every entity the key owner actively represents. Agent Keys are limited to entities incorporated through the API and need active representation and the listed `agent:entity.filing.*` scope. Agent writes also require an active Manifestation of Will. OAuth tokens and Partner Keys cannot call these filing endpoints. See https://docs.eprospera.com/entity-filings for signing, payment, and recovery. Agent scope: `agent:entity.filing.read`. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Request a Certificate of Good Standing](https://docs.eprospera.com/reference/post-legal-entities-id-certificate-requests): Creates a request and its invoice, or returns the entity's existing open or issued request. Reuse after review or issuance does not re-check current tax eligibility. Pay the invoice with a voucher, or in the portal, to have the certificate issued. Tax-current entities are issued automatically after payment; contested requests go to admin review. Returns 409 with code `certificate.tax_overdue` when overdue taxes block the request and no contest was supplied. Standard keys act on every entity the key owner actively represents. Agent Keys are limited to entities incorporated through the API and need active representation and the listed `agent:entity.filing.*` scope. Agent writes also require an active Manifestation of Will. OAuth tokens and Partner Keys cannot call these filing endpoints. See https://docs.eprospera.com/entity-filings for signing, payment, and recovery. Agent scope: `agent:entity.filing.create`. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Get a Certificate of Good Standing request](https://docs.eprospera.com/reference/get-legal-entities-id-certificate-requests-request-id): Poll until `statusId` is `Issued`, `Rejected`, or `Cancelled`, then stop. Only `Issued` provides the certificate PDF at `documentUrl`, also listed in the entity documents. For `Rejected`, show `rejectionReason`; cancellation or rejection is terminal and must not trigger automatic repayment. Standard keys act on every entity the key owner actively represents. Agent Keys are limited to entities incorporated through the API and need active representation and the listed `agent:entity.filing.*` scope. Agent writes also require an active Manifestation of Will. OAuth tokens and Partner Keys cannot call these filing endpoints. See https://docs.eprospera.com/entity-filings for signing, payment, and recovery. Agent scope: `agent:entity.filing.read`. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Pay a Certificate of Good Standing request with a voucher](https://docs.eprospera.com/reference/post-legal-entities-id-certificate-requests-request-id-pay-voucher): Applies the voucher to the request invoice. Entity eligibility and tax compliance are rechecked before payment, including existing invoices. Overdue filings require a saved dispute note and proof; unknown compliance blocks payment. Failures return 400 without redeeming the voucher. Issuance runs asynchronously after payment. Poll until `statusId` is `Issued`, `Rejected`, or `Cancelled`, then stop. A certificate `documentUrl` is available only for `Issued`; rejected or cancelled requests must not trigger automatic repayment. Standard keys act on every entity the key owner actively represents. Agent Keys are limited to entities incorporated through the API and need active representation and the listed `agent:entity.filing.*` scope. Agent writes also require an active Manifestation of Will. OAuth tokens and Partner Keys cannot call these filing endpoints. See https://docs.eprospera.com/entity-filings for signing, payment, and recovery. Agent scope: `agent:entity.filing.pay`. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [List legal-entity applications](https://docs.eprospera.com/reference/get-legal-entity-applications): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Create a legal-entity application](https://docs.eprospera.com/reference/post-legal-entity-applications): For PES registered-agent customers, the principal office is set to the PES registered office from the provider record, including when PES is selected by permit number. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Get a legal-entity application](https://docs.eprospera.com/reference/get-legal-entity-applications-id): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Pay a legal-entity application with a voucher](https://docs.eprospera.com/reference/post-legal-entity-applications-id-pay-voucher): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Create a hosted checkout session](https://docs.eprospera.com/reference/post-legal-entity-applications-id-checkout-session): Returns 409 with code payment_in_progress while an existing payment is being checked. Poll the application payment state before requesting another checkout. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [List partner residency applications](https://docs.eprospera.com/reference/get-residency-applications) - [Create a partner residency application](https://docs.eprospera.com/reference/post-residency-applications): Creates a Draft owned by your integration and, for an applicant without an existing eProspera password, emails a single-use 24-hour account-claim link. Requires `Idempotency-Key`. - [Get a partner residency application](https://docs.eprospera.com/reference/get-residency-applications-id) - [Update a draft partner residency application](https://docs.eprospera.com/reference/patch-residency-applications-id): Replaces the application data of a Draft. Requires the latest `version` as `expectedVersion`. Any change to `applicationData` invalidates the current agreement acceptance and returns a fresh `nextSteps.agreementUrl`. Once the invoice is paid, `residencyType` and the applicant email are locked. Changing the applicant email sends a new claim email to the new address. - [Get agreement documents for a partner residency application](https://docs.eprospera.com/reference/get-residency-applications-id-documents): Returns the Agreement of Coexistence the applicant accepted for this application, including the template PDF for that version, and, once the residency exists, its signed agreement and the applicant’s policy documents. Signed agreements must match this application’s residency ID; agreements for other residencies, identity-verification artifacts, and tax documents are never returned. Requires `partner:person.application.read`. - [Upload proof of address](https://docs.eprospera.com/reference/post-uploads-proof-of-address): Multipart upload of a PDF, JPEG, or PNG up to 4.5 MB for a Draft owned by your integration. The declared MIME type must match the file bytes. The response carries an opaque `id` to attach through PATCH as `proofOfAddressUploadId`; no URL is returned. - [Download proof of address](https://docs.eprospera.com/reference/get-uploads-proof-of-address-id) - [Create a partner hosted-checkout session](https://docs.eprospera.com/reference/post-residency-applications-id-checkout-session): Creates a hosted checkout for the application invoice. Send exactly one of `paymentProvider` or `paymentMethod`. `redirectUrl` must use an approved redirect origin; Stripe returns the payer to `redirectUrl?success=true` on success and to `redirectUrl` on cancel. The response is `{ data: { url }, invoiceId }`. Payment is confirmed asynchronously: poll the application until `nextSteps.paymentRequired` is false. Requires `Idempotency-Key`. - [Pay a partner application with a voucher](https://docs.eprospera.com/reference/post-residency-applications-id-pay-voucher): Applies a voucher that must cover the full invoice. Returns the updated application with `nextSteps.paymentRequired` false. Voucher errors carry a machine-readable `code`: `voucher_not_found`, `voucher_expired`, `voucher_already_redeemed`, `voucher_not_applicable`, `voucher_not_full_coverage`, `invoice_not_found`. Requires `Idempotency-Key`. - [Create a secure agreement and KYC embed session](https://docs.eprospera.com/reference/post-residency-applications-id-embed-sessions): Requires `partner:person.embed_session.create`. The application must be partner-owned, complete except for agreement/KYC, and paid. The one-time URL is bound to the parent-held PKCE verifier and may only be framed by the selected allow-listed origin. Issuance is not idempotent: retrying this operation creates a replacement link and revokes any previously active embed session for the application. - [Submit a partner residency application](https://docs.eprospera.com/reference/post-residency-applications-id-submit): Moves a Draft to `Pending Review`. Requires current agreement acceptance, proof of address, a paid invoice, and approved identity verification. Given name and surname must each contain 1–100 characters after trimming, beginning with a letter and containing only Unicode letters, combining marks, joiners, spaces, hyphens, apostrophes, middle dots or periods. Email addresses and numbers are invalid names. Obvious placeholder names require manual review. No request body; not idempotent. - [Get the authenticated natural person](https://docs.eprospera.com/reference/oauth-get-natural-person): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Get ID-verification artifacts](https://docs.eprospera.com/reference/oauth-get-id-verification): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Get natural-person residency status](https://docs.eprospera.com/reference/oauth-get-natural-person-residency): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [List the authenticated person’s documents](https://docs.eprospera.com/reference/oauth-get-natural-person-documents): Returns the documents the portal shows the signed-in person: the signed Agreement of Coexistence, accepted policies, and other generated documents, excluding admin-only or hidden records. `agreementOfCoexistence` describes the agreement behind the active residency. Agent scope: `agent:person.documents.read`. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [List consented legal entities](https://docs.eprospera.com/reference/oauth-get-legal-entities): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Get a consented legal entity](https://docs.eprospera.com/reference/oauth-get-legal-entities-id): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [List documents for a consented legal entity](https://docs.eprospera.com/reference/oauth-get-legal-entities-id-documents): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Get tax obligations and lump-sum election status](https://docs.eprospera.com/reference/oauth-get-tax-summary): Personal VAT obligations honor staff-recorded ongoing applicability. Period-specific reviewed decisions and active manual filing requirements take precedence. Changes to filing applicability do not remove submitted filings or payment balances. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [List submitted tax filings](https://docs.eprospera.com/reference/oauth-list-tax-filings): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Get a submitted tax filing](https://docs.eprospera.com/reference/oauth-get-tax-filing): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Download a tax assessment or filed income return](https://docs.eprospera.com/reference/oauth-download-tax-document): For a submitted individual income return, downloads the saved Form 1 PDF when available; otherwise renders it from the filed amounts and original submission date. Returns 400 when incomplete or conflicting historical filing data requires review. Hidden or admin-only saved returns are unavailable to residents and return 404. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [List referrals for a referral code](https://docs.eprospera.com/reference/get-referral-codes-code-referrals): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Create a public Visitor Pass application](https://docs.eprospera.com/reference/post-visitor-pass-applications): This endpoint does not require an API key, but every request requires a fresh Cloudflare Turnstile token (turnstileToken) for action visitor-pass from an approved hostname. The server verifies it before any account creation, application processing, or email. Missing, invalid, expired, replayed, wrong-action, or wrong-hostname tokens return 400; verification outages or missing configuration return 503. The applicant must provide consent and a signature as a canonical base64 PNG data URL (data:image/png;base64,...), with at most 512 KiB of image data and 4 million pixels. The image must fully decode and be embeddable in the agreement PDF. Invalid signatures return 400 before an account or application is created. - [Identify VAT taxpayers and open quarters](https://docs.eprospera.com/reference/oauth-get-vat-context): Returns registered taxpayer identity (name, UUID, RPN), candidate open quarters, and the declaration text. Personal and entity scopes authorize only their respective subjects. Entities also require current representation and token-specific consent. Eligibility is rechecked on writes. No identity-document images are returned. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Create or resume a quarterly VAT draft](https://docs.eprospera.com/reference/oauth-create-vat-draft): Use personal for the caller or a consented legal-entity UUID. Taxpayer+quarter is the retry key: returns an existing original draft without replacing figures. Already-filed quarters, multiple drafts, and BTC/amendment drafts return 409. USD originals only. A registered RPN and eligible quarter are required. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Read a VAT draft or submission receipt](https://docs.eprospera.com/reference/oauth-get-vat-filing): Returns reported figures, server-calculated USD liability, current revision, payment readiness, and submittedAt as the submission receipt. The assessment link requires the matching tax read scope. Relative links use the current portal/API origin. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Save and calculate VAT figures](https://docs.eprospera.com/reference/oauth-update-vat-draft): Replace all reported figures using decimal strings and the latest revision. Stale revisions return 412. Submitted filings and processed invoices cannot be edited; an unprocessed invoice is voided before recalculation. A successful write returns a new revision. After a timeout, read the filing before retrying. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Submit a reviewed quarterly VAT filing](https://docs.eprospera.com/reference/oauth-submit-vat-draft): Requires the latest revision and explicit acceptance of the declaration from VAT context. Preserves server-side ownership, period, tax-credit and authoritative settlement checks. Zero-liability filings need no invoice; positive liability requires existing payment evidence. Use links.portal for payment. Repeating a successful submission with the same revision returns the existing receipt. No charges are initiated by this endpoint. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Get OpenID Provider metadata](https://docs.eprospera.com/reference/oauth-openid-configuration) - [Get OAuth signing keys](https://docs.eprospera.com/reference/oauth-jwks) - [Start the OAuth authorization-code flow](https://docs.eprospera.com/reference/oauth-authorize) - [Start an OAuth device authorization](https://docs.eprospera.com/reference/oauth-device-authorization) - [Exchange an authorization code, device code, or refresh token](https://docs.eprospera.com/reference/oauth-token): Use HTTP Basic client authentication when possible. client_secret_post remains supported for compatibility. Public device clients send client_id without a secret. Repeated parameters and multiple client authentication methods are rejected. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Get OpenID Connect user claims](https://docs.eprospera.com/reference/oauth-userinfo): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Get OpenID Connect user claims](https://docs.eprospera.com/reference/oauth-userinfo-post): POST variant of the OpenID Connect UserInfo endpoint. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Revoke an OAuth token](https://docs.eprospera.com/reference/oauth-revoke): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Introspect an OAuth token](https://docs.eprospera.com/reference/oauth-introspect): Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Deprecated legal-entity coupon-payment alias](https://docs.eprospera.com/reference/post-legal-entity-applications-id-pay-coupon): Use `/api/v1/legal_entity_applications/{id}/pay/voucher` with `voucherCode` instead. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Deprecated partner coupon-payment alias](https://docs.eprospera.com/reference/post-residency-applications-id-pay-coupon): Use `/api/v1/partner/residency_applications/{id}/pay/voucher` with `voucherCode` instead. - [Deprecated ID-verification underscore alias](https://docs.eprospera.com/reference/oauth-get-id-verification-legacy): Use `/api/v1/me/natural-person/id-verification` instead. Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid. - [Deprecated OpenID-configuration alias](https://docs.eprospera.com/reference/oauth-openid-configuration-legacy): Use `/.well-known/openid-configuration` instead. - [Deprecated root JWKS alias](https://docs.eprospera.com/reference/oauth-jwks-legacy): Use `/api/oauth/.well-known/jwks.json` instead.