> ## Documentation Index > Fetch the complete documentation index at: https://docs.paywise.de/llms.txt > Use this file to discover all available pages before exploring further. # List the invoice documents > The document attached to this invoice (at most one), with its ingestion status: pending (scanning), ready, rejected (malware scan) or failed (the scan could not complete or the content was invalid/oversized). size and download_url are null unless ready. **Draft documentation — API not yet rolled out.** This endpoint describes the preview contract and may change before release. Sandbox access is provided separately. See [access and limitations](/api-docs/mahnservice-api/introduction). ## OpenAPI ````yaml api-docs/mahnservice-api/openapi.json GET /mahnservice/v1/invoices/{uuid}/documents/ openapi: 3.0.3 info: title: paywise Mahnservice API version: v1 description: >- Public REST API for the paywise Mahnservice (pre-collection dunning), an alternative input path to the bookkeeping integrations (Lexware Office, sevDesk) and the CSV import. Authentication uses a Bearer token (the same token works for the Inkasso API). Each token is bound to a company and a legacy access mode: `test` or `production`. Access mode is a data-isolation lane, not the API environment: modern credentials use `production` in both production and sandbox. Read `/info/`'s `environment` (`production` or `sandbox`) to identify the environment serving your request. Resources: token introspection (`/info/`), debtors (create/list/get), and the invoice lifecycle -- submit (held), upload the invoice PDF (multipart or base64; scanned asynchronously, poll the document `status`), release for dunning, report payments, cancel / write off, and read the dunning state (`dunning_state`, the dunning flow and the sent dunnings with their fees), pause and resume the dunning, and read the dunning-flow configuration (`/dunning-flows/`). Webhooks notify you about `invoice.created`, `invoice.paid`, `invoice.cancelled`, `invoice.written_off`, `dunning.level_advanced` and `dunning.handed_to_collection`. Test-mode invoices are visible everywhere but never dunned, and their events only reach test-mode endpoints. Contract: requests are JSON only (documents may also be multipart); unknown or read-only body fields and unknown query parameters are rejected with `400`; list pages take `limit` (1-100, default 10) and `offset`. Errors are English and machine-readable: every error body is `{detail, code[, errors]}` -- branch on `code` (`validation_error` with per-field `errors`, `not_authenticated`, `permission_denied` -- the token lacks the scope, `subscription_required` -- no active Mahnservice subscription (writes other than payment reporting), `company_locked` -- the account is locked by paywise (every write), `not_found`, `unsupported_media_type`, `request_too_large`, `throttled`, `unexpected_body`, and the documented `409` codes). A repeat submission of an invoice number that was cancelled, written off or archived is a `409` (`invoice_cancelled` / `invoice_written_off` / `invoice_archived`), not a replay. `HEAD` mirrors `GET` and never writes. Every response carries `X-Paywise-Request-Id`, `X-Paywise-Environment` and `Cache-Control: private, no-store`. Token scopes apply: `mahnservice:debtors:read` / `:write` and `mahnservice:invoices:read` / `:write` (a `:write` grant includes `:read`; keys minted with the full `*` grant have everything). Rate limits: 600 requests per minute per key and per company, shared with the Case Management API, plus per-operation windows of 600 reads or 120 writes per minute; a `429` carries `Retry-After`. servers: - url: https://api.paywise.de description: Production environment security: [] tags: - name: Info description: The authenticated credential and its context. - name: Debtors description: Debtors invoices are addressed to. - name: Invoices description: Held invoices, their release, payments and documents. - name: Dunning flows description: Dunning flow configurations referenced by invoices. externalDocs: url: https://docs.paywise.de/api-docs/mahnservice-api/introduction paths: /mahnservice/v1/invoices/{uuid}/documents/: get: tags: - Invoices summary: List the invoice documents description: >- The document attached to this invoice (at most one), with its ingestion status: pending (scanning), ready, rejected (malware scan) or failed (the scan could not complete or the content was invalid/oversized). size and download_url are null unless ready. operationId: list-invoice-documents parameters: - in: path name: uuid schema: type: string format: uuid required: true description: UUID of the invoice in this request. responses: '200': content: application/json: schema: type: array items: $ref: '#/components/schemas/DocumentRead' description: '' headers: X-Paywise-Request-Id: description: >- Fresh server-assigned correlation id for this response. Caller-provided request ids are ignored. schema: type: string format: uuid X-Paywise-Environment: description: Environment that produced the response. schema: enum: - production - sandbox type: string Cache-Control: description: >- Cacheability directive. Authenticated responses use `private, no-store`; the legal-form catalog may use `private, max-age=86400`. schema: type: string '401': description: Standard error response. content: application/json: schema: $ref: '#/components/schemas/Error' headers: X-Paywise-Request-Id: description: >- Fresh server-assigned correlation id for this response. Caller-provided request ids are ignored. schema: type: string format: uuid X-Paywise-Environment: description: Environment that produced the response. schema: enum: - production - sandbox type: string Cache-Control: description: >- Cacheability directive. Authenticated responses use `private, no-store`; the legal-form catalog may use `private, max-age=86400`. schema: type: string '403': description: Standard error response. content: application/json: schema: $ref: '#/components/schemas/Error' headers: X-Paywise-Request-Id: description: >- Fresh server-assigned correlation id for this response. Caller-provided request ids are ignored. schema: type: string format: uuid X-Paywise-Environment: description: Environment that produced the response. schema: enum: - production - sandbox type: string Cache-Control: description: >- Cacheability directive. Authenticated responses use `private, no-store`; the legal-form catalog may use `private, max-age=86400`. schema: type: string '404': description: Standard error response. content: application/json: schema: $ref: '#/components/schemas/Error' headers: X-Paywise-Request-Id: description: >- Fresh server-assigned correlation id for this response. Caller-provided request ids are ignored. schema: type: string format: uuid X-Paywise-Environment: description: Environment that produced the response. schema: enum: - production - sandbox type: string Cache-Control: description: >- Cacheability directive. Authenticated responses use `private, no-store`; the legal-form catalog may use `private, max-age=86400`. schema: type: string '429': description: Standard error response. content: application/json: schema: $ref: '#/components/schemas/Error' headers: X-Paywise-Request-Id: description: >- Fresh server-assigned correlation id for this response. Caller-provided request ids are ignored. schema: type: string format: uuid X-Paywise-Environment: description: Environment that produced the response. schema: enum: - production - sandbox type: string Cache-Control: description: >- Cacheability directive. Authenticated responses use `private, no-store`; the legal-form catalog may use `private, max-age=86400`. schema: type: string Retry-After: description: Integer seconds to wait before retrying a throttled request. schema: type: integer minimum: 1 '500': description: Standard error response. content: application/json: schema: $ref: '#/components/schemas/Error' headers: X-Paywise-Request-Id: description: >- Fresh server-assigned correlation id for this response. Caller-provided request ids are ignored. schema: type: string format: uuid X-Paywise-Environment: description: Environment that produced the response. schema: enum: - production - sandbox type: string Cache-Control: description: >- Cacheability directive. Authenticated responses use `private, no-store`; the legal-form catalog may use `private, max-age=86400`. schema: type: string security: - tokenAuth: [] components: schemas: DocumentRead: type: object description: Read shape of an invoice document. properties: id: type: string format: uuid readOnly: true filename: type: string readOnly: true nullable: true description: Stored document filename, or null when no filename is available. mime_type: type: string readOnly: true nullable: true description: >- Document media type (application/pdf for an accepted PDF), or null when unavailable. size: type: integer readOnly: true nullable: true description: >- Document size in bytes. Null before ready, and may remain null if the size of a legacy document cannot be retrieved. status: allOf: - $ref: '#/components/schemas/CaseDocumentStatusEnum' readOnly: true description: >- Document ingestion state: pending while processing, ready after acceptance, rejected when content is rejected, or failed when ingestion/scanning cannot complete. Replace a rejected or failed document while the invoice is held to try again. download_url: type: string format: uri readOnly: true nullable: true description: >- Authenticated API URL for downloading the invoice PDF; null unless the document is ready. created_at: type: string format: date-time readOnly: true description: >- Creation time of the stable document resource; unchanged when its contents are replaced. updated_at: type: string format: date-time readOnly: true required: - created_at - download_url - filename - id - mime_type - size - status - updated_at Error: type: object properties: detail: type: string description: Short human-readable summary of the error. code: type: string description: Machine-readable error category. errors: type: array items: $ref: '#/components/schemas/ErrorItem' description: Field-level validation errors, when applicable. required: - detail - code additionalProperties: false CaseDocumentStatusEnum: enum: - pending - ready - rejected - failed type: string description: |- * `pending` - pending * `ready` - ready * `rejected` - rejected * `failed` - failed ErrorItem: type: object properties: field: type: string nullable: true description: >- Path to the field that caused the error, using dots for objects and brackets for list indexes, for example `claims[0].amount`; null for an error without a field path. code: type: string description: Machine-readable field error code. message: type: string description: Human-readable explanation of the field error. required: - field - code - message additionalProperties: false securitySchemes: tokenAuth: type: http scheme: bearer ````