Skip to main content
Some Croma lookups take longer to return, anywhere from a few seconds to a couple of minutes. These run as async jobs: the same request can resolve three different ways, and you choose which one fits your app.
You don’t have to do anything special. By default these endpoints behave like any other: you POST and get { "data": … } back. The options below are opt-in, for when you’d rather not hold a connection open.

Which endpoints are async?

These lookups run as async jobs: Colombia Peru Mexico
  • SIEM, business establishments
Every other endpoint answers synchronously, with no job involved.

The three ways to get a result

All three are backed by the same job, so pick per request.
If Croma already has a fresh result for the same query, any mode returns 200 { data } right away (X-Cache: HIT header) and no job is created; in callback mode no POST follows. Always handle a direct 200.

Mode 1: Wait inline (default)

Just call the endpoint. The request holds open until the job finishes (up to 55 seconds) and returns the result in the usual { data } shape, identical to a synchronous endpoint.
Control how long to wait with the standard Prefer: wait=N header (seconds, clamped to 55):
  • 200: finished. Body is { "data": … }, same as the synchronous shape.
  • 202: not finished within the wait. Body is a job envelope; follow its status_url to poll. The X-Job-Id header carries the job id.
Always handle both 200 and 202. A 202 is not an error; it just means “still working, come back for it.”

Mode 2: Poll

Send Prefer: wait=0 to get a 202 immediately, then GET the job’s status_url until it reaches a terminal state.
GET /jobs/:id always returns 200 with the envelope. While the job is still running it includes a Retry-After header (seconds); use it to pace your polling. Jobs are scoped to your organization; a job belonging to another org reads as 404.

Mode 3: Callback (webhook)

Include a callback_url in the request body. You get a 202 right away, and Croma POSTs the result to your URL once the job finishes, with no polling.
callback_url must be an absolute HTTPS URL on a public host (localhost and private ranges are rejected). When the job finishes, Croma sends a POST to it:
  • Body: the same job envelope as the poll endpoint.
  • x-croma-job-id: the job id.
  • x-croma-signature: sha256=<hmac>, an HMAC-SHA256 of the raw request body, so you can verify the payload’s integrity.
Signature verification uses a shared secret issued by Croma; reach out if you want it enabled for your callbacks. Respond 2xx quickly; non-2xx responses are retried.

The job envelope

The 202 response, GET /jobs/:id, and the callback body all share one shape:
  • data is populated only when status is completed (and matches the endpoint’s normal data payload). Otherwise it’s null.
  • error is populated only when the job has failed, as { "type", "code", "message" }.

Statuses

Headers reference

Errors

How failures and the error object work.