/api/v1/cases/{id}/documents
Attach a file to a case. Multipart, with one `file` part of at most 25 MiB (26,214,400 bytes) plus the string fields below. De-duplication is by content hash and is PER CASE: the same bytes uploaded twice to one case are refused with 409 `conflict`, and `details.existing_document_id` names the copy. The same bytes on a DIFFERENT case in your organization are accepted — a voided check, an ID scan or a signed application legitimately belongs on more than one case for the same merchant. Nothing is written on the refused path. A `financial` document also starts an analysis of the case; several of them queue one run, not one each.
- Scope
documents:write- Rate limit
- 50 requests / min
- Idempotency
Idempotency-Keysupported
Authentication
Send your key as Authorization: Bearer …. It must carry the scope documents:write; a key without it receives 403 forbidden.
Path parameters
idstringrequiredHeaders
Idempotency-KeystringReplays the first response for a repeated request. Reusing a key with a different body is idempotency_key_reused (409), never a silent replay.
Request body
multipart/form-datarequiredfilefilerequiredmax 25 MBcategorystring (enum)stipulationcontractid_verificationfinancialinsurancelegalotherDefaults to other. Matched case-insensitively; the label spelling ("ID Verification") is accepted too.
namestringmax length 200Display name. Defaults to the uploaded filename.
descriptionstringmax length 200Alias of name, read only when name is absent.
Response
201application/jsonSerializedDocumentidstringrequiredcase_idstring | nullrequirednullablenamestringrequiredfile_namestringrequiredfile_typestringrequiredfile_sizestringrequiredcategorystringrequiredstatusstringrequiredapplicantstring | nullrequirednullableversionnumberrequireduploaded_bystringrequireduploaded_atstring | nullrequirednullablereviewed_bystring | nullrequirednullablereviewed_atstring | nullrequirednullablerejection_reasonstring | nullrequirednullableErrors
The statuses this operation can return, with the error.code values behind each. Every error body is the shared envelope described under Errors in Getting started.
400validation_error401unauthorized403forbidden404not_found409conflictidempotency_key_reused429rate_limit_exceeded500internal_error