---
title: "Look up medical authorizations"
description: "Read authorizations for the supplied beneficiary document. Only a successful empty array means no matches; provider errors do not establish whether authorizations exist.\n\n- **Scope:** `axxa:authorizations:read`\n- **Credentials:** an API key, a client-credentials token or a person's access token\n- **Effect:** read-only; safe to retry\n- **Limits:** request body up to 32 KB, response up to 256 KB\n- **CLI:** `arbol axxa authorizations lookup` · **MCP tool:** `axxa_authorizations_lookup`"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.getarbol.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: AXA API › Authorizations

`POST /v1/axxa/authorizations/lookup`

Read authorizations for the supplied beneficiary document. Only a successful empty array means no matches; provider errors do not establish whether authorizations exist.

- **Scope:** `axxa:authorizations:read`
- **Credentials:** an API key, a client-credentials token or a person's access token
- **Effect:** read-only; safe to retry
- **Limits:** request body up to 32 KB, response up to 256 KB
- **CLI:** `arbol axxa authorizations lookup` · **MCP tool:** `axxa_authorizations_lookup`

## Authentication

Requires one of the following:

- `arbolHuman`, oauth2, scopes: `axxa:authorizations:read`
- `arbolMachine`, oauth2, scopes: `axxa:authorizations:read`
- `arbolApiKey`, http, header `Authorization`

## Request body

_Required._

- `documentNumber` (`axxa.authorizations.lookup.documentNumber`; string, required)
  - pattern `^[A-Za-z0-9]{3,30}$`
- `connectionId` (`axxa.authorizations.lookup.connectionId`; string, optional)
  - pattern `^con_[0-9A-Za-z]{26}$`

## Example request

```json
{
  "documentNumber": "string",
  "connectionId": "string"
}
```

## Code samples

### cURL

```bash
curl https://api.getarbol.com/v1/axxa/authorizations/lookup \
  --request POST \
  --header "Authorization: Bearer $ARBOL_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
  "documentNumber": "<documentNumber>"
}'
```

### TypeScript

```typescript
import { createClient } from "@arbol-ai/sdk";

const arbol = createClient({
  baseUrl: "https://api.getarbol.com",
  token: process.env.ARBOL_API_KEY!,
});

const { data } = await arbol.axxa.authorizations.lookup({
  documentNumber: "<documentNumber>",
});
```

### Rust

```rust
use arbol_sdk::{types, Client, Credential};

let arbol = Client::new(Credential::ApiKey(std::env::var("ARBOL_API_KEY")?))?;

let data = arbol
    .axxa()
    .authorizations()
    .lookup(&types::AxxaAuthorizationsLookupInput {
        document_number: "<documentNumber>".into(),
        connection_id: None,
    })
    .await?;
```

### CLI

```bash
arbol axxa authorizations lookup --document-number '<documentNumber>'
```

### MCP

```json
{
  "name": "axxa_authorizations_lookup",
  "arguments": {
    "documentNumber": "<documentNumber>"
  }
}
```

## Responses

### 200

Successful operation.

#### Example

```json
{
  "success": true,
  "data": {
    "authorizations": [
      {
        "authorizationNumber": "string",
        "requestNumber": "string",
        "requestedAt": "string",
        "authorizedAt": "string",
        "product": "string",
        "services": [
          {
            "code": "string",
            "description": "string"
          }
        ],
        "diagnosis": {
          "code": "string",
          "description": "string"
        }
      }
    ],
    "beneficiary": {
      "name": "string",
      "documentNumber": "string"
    }
  },
  "error": null,
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`axxa.authorizations.lookup.response.200.success`; boolean, required)
  - one of `true`
- `data` (`axxa.authorizations.lookup.response.200.data`; object, required) — Only an empty authorizations array confirms no matches. Provider failures are errors.
  - `authorizations` (`axxa.authorizations.lookup.response.200.data.authorizations`; array<object>, required)
    - `authorizationNumber` (`axxa.authorizations.lookup.response.200.data.authorizations.authorizationNumber`; string, required)
      - minLength 1; maxLength 100
    - `requestNumber` (`axxa.authorizations.lookup.response.200.data.authorizations.requestNumber`; string, required)
      - minLength 1; maxLength 100
    - `requestedAt` (`axxa.authorizations.lookup.response.200.data.authorizations.requestedAt`; string, required) — Date as displayed by AXA; no timezone is inferred.
      - minLength 1; maxLength 100
    - `authorizedAt` (`axxa.authorizations.lookup.response.200.data.authorizations.authorizedAt`; string, required) — Date as displayed by AXA; no timezone is inferred.
      - minLength 1; maxLength 100
    - `product` (`axxa.authorizations.lookup.response.200.data.authorizations.product`; string, required)
      - maxLength 200
    - `services` (`axxa.authorizations.lookup.response.200.data.authorizations.services`; array<object>, required)
      - `code` (`axxa.authorizations.lookup.response.200.data.authorizations.services.code`; string, required)
        - minLength 1; maxLength 100
      - `description` (`axxa.authorizations.lookup.response.200.data.authorizations.services.description`; string, required)
        - maxLength 2000
    - `diagnosis` (`axxa.authorizations.lookup.response.200.data.authorizations.diagnosis`; object, required)
      - `code` (`axxa.authorizations.lookup.response.200.data.authorizations.diagnosis.code`; string, required)
        - minLength 1; maxLength 100
      - `description` (`axxa.authorizations.lookup.response.200.data.authorizations.diagnosis.description`; string, required)
        - maxLength 2000
  - `beneficiary` (`axxa.authorizations.lookup.response.200.data.beneficiary`; object | null, required)
    - `name` (`axxa.authorizations.lookup.response.200.data.beneficiary.name`; string, required)
      - minLength 1; maxLength 300
    - `documentNumber` (`axxa.authorizations.lookup.response.200.data.beneficiary.documentNumber`; string, required)
      - pattern `^[A-Za-z0-9]{3,30}$`
- `error` (`axxa.authorizations.lookup.response.200.error`; unknown, required)
- `metadata` (`axxa.authorizations.lookup.response.200.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`axxa.authorizations.lookup.response.200.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 400

`INVALID_INPUT`: The request does not match the published schema.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "INVALID_INPUT",
    "message": "string",
    "retryable": false,
    "data": {
      "issues": [
        {
          "path": "string",
          "message": "string"
        }
      ]
    }
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`axxa.authorizations.lookup.response.400.success`; boolean, required)
  - one of `false`
- `data` (`axxa.authorizations.lookup.response.400.data`; unknown, required)
- `error` (`axxa.authorizations.lookup.response.400.error`; object, required) — The request does not match the published schema.
  - `code` (`axxa.authorizations.lookup.response.400.error.code`; string, required) — The failure code, stable across releases.
    - one of `"INVALID_INPUT"`
  - `message` (`axxa.authorizations.lookup.response.400.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`axxa.authorizations.lookup.response.400.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `false`
  - `data` (`axxa.authorizations.lookup.response.400.error.data`; object, required)
    - `issues` (`axxa.authorizations.lookup.response.400.error.data.issues`; array<object>, optional)
      - `path` (`axxa.authorizations.lookup.response.400.error.data.issues.path`; string, required) — RFC 6901 JSON Pointer to the refused field; empty for the whole input.
        - maxLength 256
      - `message` (`axxa.authorizations.lookup.response.400.error.data.issues.message`; string, required)
        - maxLength 256
- `metadata` (`axxa.authorizations.lookup.response.400.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`axxa.authorizations.lookup.response.400.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 401

`UNAUTHORIZED`: A valid access token is required.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "string",
    "retryable": false,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`axxa.authorizations.lookup.response.401.success`; boolean, required)
  - one of `false`
- `data` (`axxa.authorizations.lookup.response.401.data`; unknown, required)
- `error` (`axxa.authorizations.lookup.response.401.error`; object, required) — A valid access token is required.
  - `code` (`axxa.authorizations.lookup.response.401.error.code`; string, required) — The failure code, stable across releases.
    - one of `"UNAUTHORIZED"`
  - `message` (`axxa.authorizations.lookup.response.401.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`axxa.authorizations.lookup.response.401.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `false`
  - `data` (`axxa.authorizations.lookup.response.401.error.data`; object, required) — No fields.
- `metadata` (`axxa.authorizations.lookup.response.401.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`axxa.authorizations.lookup.response.401.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 403

- `FORBIDDEN`: The token does not authorize this operation.
- `LOGIN_REJECTED`: The organization's connection to this integration couldn't complete the request. Don't retry it automatically; if it keeps happening, contact your Arbol team.
- `ACCOUNT_MISMATCH`: The portal session does not match the configured account and branch.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "FORBIDDEN",
    "message": "string",
    "retryable": false,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`axxa.authorizations.lookup.response.403.success`; boolean, required)
  - one of `false`
- `data` (`axxa.authorizations.lookup.response.403.data`; unknown, required)
- `error` (`axxa.authorizations.lookup.response.403.error`; one of, required)
  - one of: `ForbiddenFailure`, `AxxaLoginRejectedFailure`, `AxxaAccountMismatchFailure`
  - discriminator: `code`
- `metadata` (`axxa.authorizations.lookup.response.403.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`axxa.authorizations.lookup.response.403.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 404

`CONNECTION_NOT_FOUND`: The organization has no such connection.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "CONNECTION_NOT_FOUND",
    "message": "string",
    "retryable": false,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`axxa.authorizations.lookup.response.404.success`; boolean, required)
  - one of `false`
- `data` (`axxa.authorizations.lookup.response.404.data`; unknown, required)
- `error` (`axxa.authorizations.lookup.response.404.error`; object, required) — The organization has no such connection.
  - `code` (`axxa.authorizations.lookup.response.404.error.code`; string, required) — The failure code, stable across releases.
    - one of `"CONNECTION_NOT_FOUND"`
  - `message` (`axxa.authorizations.lookup.response.404.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`axxa.authorizations.lookup.response.404.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `false`
  - `data` (`axxa.authorizations.lookup.response.404.error.data`; object, required) — No fields.
- `metadata` (`axxa.authorizations.lookup.response.404.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`axxa.authorizations.lookup.response.404.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 409

- `NOT_CONFIGURED`: This organization has no AXA account configured. Contact your administrator.
- `SESSION_REQUIRED`: The organization's connection to this integration couldn't complete the request. Don't retry it automatically; if it keeps happening, contact your Arbol team.
- `SESSION_BUSY`: The organization's connection to this integration couldn't complete the request. Don't retry it automatically; if it keeps happening, contact your Arbol team.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "NOT_CONFIGURED",
    "message": "string",
    "retryable": false,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`axxa.authorizations.lookup.response.409.success`; boolean, required)
  - one of `false`
- `data` (`axxa.authorizations.lookup.response.409.data`; unknown, required)
- `error` (`axxa.authorizations.lookup.response.409.error`; one of, required)
  - one of: `AxxaNotConfiguredFailure`, `AxxaSessionRequiredFailure`, `AxxaSessionBusyFailure`
  - discriminator: `code`
- `metadata` (`axxa.authorizations.lookup.response.409.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`axxa.authorizations.lookup.response.409.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 413

`REQUEST_TOO_LARGE`: The request exceeds the allowed size.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "REQUEST_TOO_LARGE",
    "message": "string",
    "retryable": false,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`axxa.authorizations.lookup.response.413.success`; boolean, required)
  - one of `false`
- `data` (`axxa.authorizations.lookup.response.413.data`; unknown, required)
- `error` (`axxa.authorizations.lookup.response.413.error`; object, required) — The request exceeds the allowed size.
  - `code` (`axxa.authorizations.lookup.response.413.error.code`; string, required) — The failure code, stable across releases.
    - one of `"REQUEST_TOO_LARGE"`
  - `message` (`axxa.authorizations.lookup.response.413.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`axxa.authorizations.lookup.response.413.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `false`
  - `data` (`axxa.authorizations.lookup.response.413.error.data`; object, required) — No fields.
- `metadata` (`axxa.authorizations.lookup.response.413.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`axxa.authorizations.lookup.response.413.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 415

`UNSUPPORTED_MEDIA_TYPE`: The request content type is not supported.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "UNSUPPORTED_MEDIA_TYPE",
    "message": "string",
    "retryable": false,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`axxa.authorizations.lookup.response.415.success`; boolean, required)
  - one of `false`
- `data` (`axxa.authorizations.lookup.response.415.data`; unknown, required)
- `error` (`axxa.authorizations.lookup.response.415.error`; object, required) — The request content type is not supported.
  - `code` (`axxa.authorizations.lookup.response.415.error.code`; string, required) — The failure code, stable across releases.
    - one of `"UNSUPPORTED_MEDIA_TYPE"`
  - `message` (`axxa.authorizations.lookup.response.415.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`axxa.authorizations.lookup.response.415.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `false`
  - `data` (`axxa.authorizations.lookup.response.415.error.data`; object, required) — No fields.
- `metadata` (`axxa.authorizations.lookup.response.415.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`axxa.authorizations.lookup.response.415.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 428

`CAPTCHA_REQUIRED`: The organization's connection to this integration couldn't complete the request. Don't retry it automatically; if it keeps happening, contact your Arbol team.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "CAPTCHA_REQUIRED",
    "message": "string",
    "retryable": false
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`axxa.authorizations.lookup.response.428.success`; boolean, required)
  - one of `false`
- `data` (`axxa.authorizations.lookup.response.428.data`; unknown, required)
- `error` (`axxa.authorizations.lookup.response.428.error`; object, required) — The organization's connection to this integration couldn't complete the request. Don't retry it automatically; if it keeps happening, contact your Arbol team.
  - `code` (`axxa.authorizations.lookup.response.428.error.code`; string, required) — The failure code, stable across releases.
    - one of `"CAPTCHA_REQUIRED"`
  - `message` (`axxa.authorizations.lookup.response.428.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`axxa.authorizations.lookup.response.428.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `false`
- `metadata` (`axxa.authorizations.lookup.response.428.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`axxa.authorizations.lookup.response.428.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 429

- `RATE_LIMITED`: The request rate limit was exceeded. Try again later.
- `LOGIN_COOLDOWN`: The organization's connection to this integration couldn't complete the request. Don't retry it automatically; if it keeps happening, contact your Arbol team.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "RATE_LIMITED",
    "message": "string",
    "retryable": true,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`axxa.authorizations.lookup.response.429.success`; boolean, required)
  - one of `false`
- `data` (`axxa.authorizations.lookup.response.429.data`; unknown, required)
- `error` (`axxa.authorizations.lookup.response.429.error`; one of, required)
  - one of: `RateLimitedFailure`, `AxxaLoginCooldownFailure`
  - discriminator: `code`
- `metadata` (`axxa.authorizations.lookup.response.429.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`axxa.authorizations.lookup.response.429.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 500

`INTERNAL_ERROR`: The service could not complete the operation.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "INTERNAL_ERROR",
    "message": "string",
    "retryable": false,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`axxa.authorizations.lookup.response.500.success`; boolean, required)
  - one of `false`
- `data` (`axxa.authorizations.lookup.response.500.data`; unknown, required)
- `error` (`axxa.authorizations.lookup.response.500.error`; object, required) — The service could not complete the operation.
  - `code` (`axxa.authorizations.lookup.response.500.error.code`; string, required) — The failure code, stable across releases.
    - one of `"INTERNAL_ERROR"`
  - `message` (`axxa.authorizations.lookup.response.500.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`axxa.authorizations.lookup.response.500.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `false`
  - `data` (`axxa.authorizations.lookup.response.500.error.data`; object, required) — No fields.
- `metadata` (`axxa.authorizations.lookup.response.500.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`axxa.authorizations.lookup.response.500.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 502

- `OUTCOME_UNKNOWN`: The operation may have been applied; check its result before repeating it.
- `PORTAL_CHANGED`: The organization's connection to this integration couldn't complete the request. Don't retry it automatically; if it keeps happening, contact your Arbol team.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "OUTCOME_UNKNOWN",
    "message": "string",
    "retryable": false,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`axxa.authorizations.lookup.response.502.success`; boolean, required)
  - one of `false`
- `data` (`axxa.authorizations.lookup.response.502.data`; unknown, required)
- `error` (`axxa.authorizations.lookup.response.502.error`; one of, required)
  - one of: `OutcomeUnknownFailure`, `AxxaPortalChangedFailure`
  - discriminator: `code`
- `metadata` (`axxa.authorizations.lookup.response.502.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`axxa.authorizations.lookup.response.502.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 503

- `UPSTREAM_UNAVAILABLE`: The upstream service could not complete the request.
- `CAPTCHA_UNAVAILABLE`: The organization's connection to this integration couldn't complete the request. Don't retry it automatically; if it keeps happening, contact your Arbol team.
- `CAPTCHA_PAUSED`: The organization's connection to this integration couldn't complete the request. Don't retry it automatically; if it keeps happening, contact your Arbol team.
- `PORTAL_UNAVAILABLE`: The organization's connection to this integration couldn't complete the request. Don't retry it automatically; if it keeps happening, contact your Arbol team.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "UPSTREAM_UNAVAILABLE",
    "message": "string",
    "retryable": true,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`axxa.authorizations.lookup.response.503.success`; boolean, required)
  - one of `false`
- `data` (`axxa.authorizations.lookup.response.503.data`; unknown, required)
- `error` (`axxa.authorizations.lookup.response.503.error`; one of, required)
  - one of: `UpstreamUnavailableFailure`, `AxxaCaptchaUnavailableFailure`, `AxxaCaptchaPausedFailure`, `AxxaPortalUnavailableFailure`
  - discriminator: `code`
- `metadata` (`axxa.authorizations.lookup.response.503.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`axxa.authorizations.lookup.response.503.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.

### 504

`UPSTREAM_TIMEOUT`: The upstream service did not respond before its deadline.

#### Example

```json
{
  "success": false,
  "data": null,
  "error": {
    "code": "UPSTREAM_TIMEOUT",
    "message": "string",
    "retryable": true,
    "data": {}
  },
  "metadata": {
    "requestId": "string"
  }
}
```

- `success` (`axxa.authorizations.lookup.response.504.success`; boolean, required)
  - one of `false`
- `data` (`axxa.authorizations.lookup.response.504.data`; unknown, required)
- `error` (`axxa.authorizations.lookup.response.504.error`; object, required) — The upstream service did not respond before its deadline.
  - `code` (`axxa.authorizations.lookup.response.504.error.code`; string, required) — The failure code, stable across releases.
    - one of `"UPSTREAM_TIMEOUT"`
  - `message` (`axxa.authorizations.lookup.response.504.error.message`; string, required) — What went wrong, for people; it never contains input values.
  - `retryable` (`axxa.authorizations.lookup.response.504.error.retryable`; boolean, required) — Whether repeating the same request may succeed.
    - one of `true`
  - `data` (`axxa.authorizations.lookup.response.504.error.data`; object, required) — No fields.
- `metadata` (`axxa.authorizations.lookup.response.504.metadata`; object, required) — What every answer carries besides its data or error.
  - `requestId` (`axxa.authorizations.lookup.response.504.metadata.requestId`; string, required) — Request correlation identifier, also sent as X-Request-Id.


Source: https://docs.getarbol.com/api/axxa/authorizations/lookup/index.md