Poll, retrieve and download

These examples passed the identified Sandbox run. Use credential setup and an APPLICATION_ID from a successful creation.

Poll status

curl --silent --show-error --fail-with-body \
  "$PAYLINE_API_BASE/applications/$APPLICATION_ID/status" \
  --header "Authorization: Bearer $PAYLINE_API_KEY" \
  --dump-header status-headers.txt --output status.json

Inspect status, signing.accepted and artifacts.state independently. The status endpoint contains no raw protected answers or merchant bearer URL. Poll with backoff, honor Retry-After on 429, and stop at your desired durable state. All GETs share the 120-attempt per-caller/60-second limit; do not use a tight loop.

Artifact state	Meaning/action
`not_started`	No completed artifact process yet; continue the merchant journey.
`finalizing`	Signing can be accepted while artifacts are still processing.
`finalization_failed`	Acceptance remains durable. Escalate without asking for a new signature.
`finalized`	Use the returned version and artifact item download paths.
`unavailable`, `voided`, `superseded`	Do not invent readiness or regenerate evidence; inspect the response and contact Payline as needed.

Retrieve current answers

curl --silent --show-error --fail-with-body \
  "$PAYLINE_API_BASE/applications/$APPLICATION_ID" \
  --header "Authorization: Bearer $PAYLINE_API_KEY" \
  --output application.json

This response is sensitive. Authorized retrieval includes partner-supplied and merchant-added protected data, current ordinary answers, resolved pricing, allocation, lifecycle and artifact metadata. fieldStates distinguishes available, absent and not_applicable; do not interpret missing/unreadable protected authority as a masked success. Unreadable authority returns protected_data_unavailable; there is no fallback to signed snapshots or current pricing defaults. Access audit must commit before sensitive data is released. Current answers are not a reconstruction of the immutable signed packet. Keep the two uses separate. Never print this response to a shared terminal, browser console, analytics system or support ticket.

Download immutable artifacts

After artifacts.state is finalized, choose the returned versionId. The following uses the trusted, configured API base and the documented PDF route:

ARTIFACT_VERSION_ID="$(jq -er '.artifacts | select(.state == "finalized") | .versionId | strings | select(length > 0)' status.json)" || exit 1
export ARTIFACT_VERSION_ID
curl --silent --show-error --fail-with-body \
  "$PAYLINE_API_BASE/applications/$APPLICATION_ID/artifacts/$ARTIFACT_VERSION_ID/signed_pdf" \
  --header "Authorization: Bearer $PAYLINE_API_KEY" \
  --output signed-application.pdf

Use kind esignature_certificate for the certificate and a separate output file. Check the HTTP result before treating an output file as a PDF: an error body can also be written to the named file. Downloads recheck scope, immutable lineage, size and checksum, then commit access audit before releasing bytes. They do not regenerate artifacts or expose raw storage URLs. The object limit is 20 MiB; range delivery is not supported. Inaccessible versions return 404; unfinished artifacts return 409 artifact_not_ready; storage/integrity failures return 503 artifact_unavailable. Do not follow an untrusted URL with your credential or substitute another partner’s identifiers.

Start

Application lifecycle

Poll status

Retrieve current answers

Download immutable artifacts

​Poll status

​Retrieve current answers

​Download immutable artifacts

Poll status

Retrieve current answers

Download immutable artifacts