Documents

Upload a document

Uploads a file and creates a document record. purpose records what you will use the document for, and only your request sets it: send purpose=transaction_support to attach the document to a payout or an order, or the payout or order refuses the document id. Conduit identifies what the file contains, and its own determination is what applies; classificationStatus does not control attachment. Sending type is optional and records which requirement slot you uploaded the file against, so the file is shown against that slot. Optional multipart fields: purpose, name (human-readable label) and type. Maximum file size is 10 MB; the request may contain at most 16 multipart fields in total. File type is determined by inspecting the file’s contents — the Content-Type header and filename extension are advisory only.

POST

documents

Upload a document

curl --request POST \
  --url https://api.sandbox.conduit.financial/v2/documents \
  --header 'Content-Type: multipart/form-data' \
  --header 'x-api-key: <api-key>' \
  --form file='@example-file' \
  --form 'name=<string>'

import requests

url = "https://api.sandbox.conduit.financial/v2/documents"

files = { "file": ("example-file", open("example-file", "rb")) }
payload = { "name": "<string>" }
headers = {"x-api-key": "<api-key>"}

response = requests.post(url, data=payload, files=files, headers=headers)

print(response.text)

const form = new FormData();
form.append('file', '<string>');
form.append('name', '<string>');

const options = {method: 'POST', headers: {'x-api-key': '<api-key>'}};

options.body = form;

fetch('https://api.sandbox.conduit.financial/v2/documents', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.sandbox.conduit.financial/v2/documents",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"name\"\r\n\r\n<string>\r\n-----011000010111000001101001--",
  CURLOPT_HTTPHEADER => [
    "Content-Type: multipart/form-data",
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.sandbox.conduit.financial/v2/documents"

	payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"name\"\r\n\r\n<string>\r\n-----011000010111000001101001--")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.sandbox.conduit.financial/v2/documents")
  .header("x-api-key", "<api-key>")
  .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"name\"\r\n\r\n<string>\r\n-----011000010111000001101001--")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.sandbox.conduit.financial/v2/documents")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"name\"\r\n\r\n<string>\r\n-----011000010111000001101001--"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "classificationStatus": "pending",
  "createdAt": "2026-01-15T09:30:00.000Z",
  "updatedAt": "2026-01-15T09:30:00.000Z",
  "fileName": "passport-scan.pdf",
  "mimeType": "application/pdf",
  "name": "John Doe Passport",
  "classifiedTypes": [
    "BUSINESS_REGISTRATION"
  ],
  "purpose": "organization_onboarding",
  "fileSize": 0
}

{
  "type": "INVALID_OID_FORMAT",
  "title": "Invalid Object ID Format",
  "status": 400,
  "detail": "A path or query parameter expected a valid object identifier but received a value that does not match the expected format.",
  "resolution": "Verify that all IDs in the request URL and query parameters are correctly formatted. IDs are typically prefixed strings like 'cus_...', 'app_...', or 'doc_...'.",
  "docs": "https://conduit-v2.mintlify.app/errors#invalid-oid-format",
  "instance": "/v2/...",
  "correlationId": "00469ea4-52c1-4ffa-bd05-9f28b236a5fe",
  "timestamp": "2026-01-15T09:30:00.000Z"
}

{
  "type": "API_KEY_MISSING",
  "title": "API Key Missing",
  "status": 401,
  "detail": "The request did not include an API key. All API requests must be authenticated.",
  "resolution": "Include your API key in the 'x-api-key' header with every request.",
  "docs": "https://conduit-v2.mintlify.app/errors#api-key-missing",
  "instance": "/v2/...",
  "correlationId": "00469ea4-52c1-4ffa-bd05-9f28b236a5fe",
  "timestamp": "2026-01-15T09:30:00.000Z"
}

{
  "type": "API_KEY_READ_ONLY",
  "title": "API Key Is Read-Only",
  "status": 403,
  "detail": "This API key has read-only access and cannot perform write operations. Read-only keys may make read requests (GET, HEAD, OPTIONS) only.",
  "resolution": "Use a read-write API key for this request, or have an organization admin mint one from the dashboard.",
  "docs": "https://conduit-v2.mintlify.app/errors#api-key-read-only",
  "instance": "/v2/...",
  "correlationId": "00469ea4-52c1-4ffa-bd05-9f28b236a5fe",
  "timestamp": "2026-01-15T09:30:00.000Z"
}

{
  "type": "FILE_TOO_LARGE",
  "title": "File Too Large",
  "status": 413,
  "detail": "The uploaded file exceeds the maximum allowed size (10 MB). The response carries an extra 'field' member naming the form-field that exceeded the limit (typically 'file').",
  "resolution": "Reduce the file size and re-upload. Multi-page PDFs that exceed the limit should be split into smaller files. High-resolution images may be downscaled or re-encoded with stronger compression.",
  "docs": "https://conduit-v2.mintlify.app/errors#file-too-large",
  "instance": "/v2/...",
  "correlationId": "00469ea4-52c1-4ffa-bd05-9f28b236a5fe",
  "timestamp": "2026-01-15T09:30:00.000Z"
}

{
  "type": "UNSUPPORTED_MEDIA_TYPE",
  "title": "Unsupported Media Type",
  "status": 415,
  "detail": "The request carries a body with a Content-Type this endpoint cannot parse. JSON endpoints accept 'application/json'; a body with no Content-Type header at all is assumed to be JSON. File-upload endpoints accept only 'multipart/form-data' — JSON or undeclared bodies are rejected there.",
  "resolution": "Send the request body with the 'Content-Type: application/json' header. For file uploads, use 'Content-Type: multipart/form-data' — upload endpoints accept no other body type.",
  "docs": "https://conduit-v2.mintlify.app/errors#unsupported-media-type",
  "instance": "/v2/...",
  "correlationId": "00469ea4-52c1-4ffa-bd05-9f28b236a5fe",
  "timestamp": "2026-01-15T09:30:00.000Z"
}

{
  "type": "RATE_LIMITED",
  "title": "Rate Limited",
  "status": 429,
  "detail": "Too many requests. This error is returned by three independent checks: the per-organization bucket applied to every authenticated API request; the per-IP bucket applied to unauthenticated traffic before an API key is validated; and the per-IP bucket applied when repeated invalid API keys are submitted from the same address. Honor the Retry-After header (also exposed as retryAfterSeconds in the body) before retrying. Current limits and remaining budget are visible in X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset on rate-limited route responses.",
  "resolution": "Sleep until Retry-After seconds have elapsed, then retry. For sustained workloads exceeding the per-organization defaults, request a rate-limit increase through your support contact.",
  "docs": "https://conduit-v2.mintlify.app/errors#rate-limited",
  "instance": "/v2/...",
  "correlationId": "00469ea4-52c1-4ffa-bd05-9f28b236a5fe",
  "timestamp": "2026-01-15T09:30:00.000Z",
  "retryAfterSeconds": 3
}

{
  "type": "INTERNAL_ERROR",
  "title": "Internal Error",
  "status": 500,
  "detail": "An unexpected error occurred while processing your request.",
  "resolution": "Retry the request after a brief delay. If the error persists, contact support and include the correlationId from the error response for investigation.",
  "docs": "https://conduit-v2.mintlify.app/errors#internal-error",
  "instance": "/v2/...",
  "correlationId": "00469ea4-52c1-4ffa-bd05-9f28b236a5fe",
  "timestamp": "2026-01-15T09:30:00.000Z"
}

Authorizations

x-api-key

string

header

required

Body

multipart/form-data

file

required

Document file. Allowed types (validated by inspecting the file's magic bytes, not the filename or Content-Type header): application/pdf, image/jpeg, image/png. Maximum size: 10 MB.

purpose

enum<string>

What the document is for. A payout or order accepts only transaction_support in documents; an RFI reply accepts only rfi_response in documentIds.

Available options:

organization_onboarding,

kyc,

feature_request,

transaction_support,

rfi_response

name

string

Human-readable label for the document.

type

enum<string>

The requirement slot you uploaded this file against, from documents[].canonicalType in the requirements response. Sending it shows the file against that slot; Conduit still identifies the document itself, and that determination is what applies.

Available options:

BUSINESS_REGISTRATION,

ARTICLES_OF_INCORPORATION,

TAX_CERTIFICATE,

OPERATING_LICENSE,

REGULATORY_LICENSE,

SHAREHOLDERS_REGISTRY,

DIRECTORS_REGISTRY,

AUTHORIZATION_TO_ACT,

PROOF_OF_ADDRESS,

CERTIFICATE_OF_GOOD_STANDING,

FLOW_OF_FUNDS,

AUDITED_FINANCIAL_STATEMENT,

BANK_STATEMENT,

ORG_STRUCTURE_CHART,

AML_AUDIT,

COMPLIANCE_POLICY,

INSTITUTIONAL_INVESTOR_DOCUMENTATION,

IDENTITY_VERIFICATION,

IDENTITY_VERIFICATION_ATTESTATION,

BANK_VERIFICATION_LETTER,

INVOICE,

CONTRACT,

PAYROLL_REGISTER,

INVESTMENT_AGREEMENT

Response

string

required

Unique document identifier

Pattern: ^doc_[0-9A-Za-z]{22}$

classificationStatus

enum<string>

required

Server-side classifier lifecycle: pending (not yet run), completed (a verdict was produced — the type set may be empty), or failed (the classifier could not complete: the file may be unreadable, or a transient vendor/network error was exhausted). Transient failures are re-attempted on the next review run; a persistent failed warrants re-uploading a clearer file. A document that is never submitted with an application stays pending, a payout or order supporting document included.

Available options:

pending,

completed,

failed

createdAt

string<date-time>

required

Timestamp when the document was uploaded

Example:

"2026-01-15T09:30:00.000Z"

updatedAt

string<date-time>

required

Timestamp when the document was last updated

Example:

"2026-01-15T09:30:00.000Z"

fileName

string

Original file name as uploaded

Example:

"passport-scan.pdf"

mimeType

string

MIME type of the uploaded file

Example:

"application/pdf"

name

string

Human-readable label for the document

Example:

"John Doe Passport"

classifiedTypes

enum<string>[]

Canonical document types assigned by the server-side classifier. Omitted until classification runs (asynchronously, after the document is attached to a submitted application); the type declared at upload is stored separately and does not populate this field.

Available options:

BUSINESS_REGISTRATION,

ARTICLES_OF_INCORPORATION,

TAX_CERTIFICATE,

OPERATING_LICENSE,

REGULATORY_LICENSE,

SHAREHOLDERS_REGISTRY,

DIRECTORS_REGISTRY,

AUTHORIZATION_TO_ACT,

PROOF_OF_ADDRESS,

CERTIFICATE_OF_GOOD_STANDING,

FLOW_OF_FUNDS,

AUDITED_FINANCIAL_STATEMENT,

BANK_STATEMENT,

ORG_STRUCTURE_CHART,

AML_AUDIT,

COMPLIANCE_POLICY,

INSTITUTIONAL_INVESTOR_DOCUMENTATION,

IDENTITY_VERIFICATION,

IDENTITY_VERIFICATION_ATTESTATION,

BANK_VERIFICATION_LETTER,

INVOICE,

CONTRACT,

PAYROLL_REGISTER,

INVESTMENT_AGREEMENT

purpose

enum<string>

What the document was uploaded for, as declared by the uploader. Omitted when the upload declared none. Only a transaction_support document can be attached to a payout or an order.

Available options:

organization_onboarding,

kyc,

feature_request,

transaction_support,

rfi_response

fileSize

integer

Size in bytes. Omitted for documents uploaded before size capture was added.

Required range: -9007199254740991 <= x <= 9007199254740991

⌘I

Upload a document

curl --request POST \
  --url https://api.sandbox.conduit.financial/v2/documents \
  --header 'Content-Type: multipart/form-data' \
  --header 'x-api-key: <api-key>' \
  --form file='@example-file' \
  --form 'name=<string>'

import requests

url = "https://api.sandbox.conduit.financial/v2/documents"

files = { "file": ("example-file", open("example-file", "rb")) }
payload = { "name": "<string>" }
headers = {"x-api-key": "<api-key>"}

response = requests.post(url, data=payload, files=files, headers=headers)

print(response.text)

const form = new FormData();
form.append('file', '<string>');
form.append('name', '<string>');

const options = {method: 'POST', headers: {'x-api-key': '<api-key>'}};

options.body = form;

fetch('https://api.sandbox.conduit.financial/v2/documents', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.sandbox.conduit.financial/v2/documents",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"name\"\r\n\r\n<string>\r\n-----011000010111000001101001--",
  CURLOPT_HTTPHEADER => [
    "Content-Type: multipart/form-data",
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.sandbox.conduit.financial/v2/documents"

	payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"name\"\r\n\r\n<string>\r\n-----011000010111000001101001--")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.sandbox.conduit.financial/v2/documents")
  .header("x-api-key", "<api-key>")
  .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"name\"\r\n\r\n<string>\r\n-----011000010111000001101001--")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.sandbox.conduit.financial/v2/documents")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"name\"\r\n\r\n<string>\r\n-----011000010111000001101001--"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "classificationStatus": "pending",
  "createdAt": "2026-01-15T09:30:00.000Z",
  "updatedAt": "2026-01-15T09:30:00.000Z",
  "fileName": "passport-scan.pdf",
  "mimeType": "application/pdf",
  "name": "John Doe Passport",
  "classifiedTypes": [
    "BUSINESS_REGISTRATION"
  ],
  "purpose": "organization_onboarding",
  "fileSize": 0
}

{
  "type": "INVALID_OID_FORMAT",
  "title": "Invalid Object ID Format",
  "status": 400,
  "detail": "A path or query parameter expected a valid object identifier but received a value that does not match the expected format.",
  "resolution": "Verify that all IDs in the request URL and query parameters are correctly formatted. IDs are typically prefixed strings like 'cus_...', 'app_...', or 'doc_...'.",
  "docs": "https://conduit-v2.mintlify.app/errors#invalid-oid-format",
  "instance": "/v2/...",
  "correlationId": "00469ea4-52c1-4ffa-bd05-9f28b236a5fe",
  "timestamp": "2026-01-15T09:30:00.000Z"
}

{
  "type": "API_KEY_MISSING",
  "title": "API Key Missing",
  "status": 401,
  "detail": "The request did not include an API key. All API requests must be authenticated.",
  "resolution": "Include your API key in the 'x-api-key' header with every request.",
  "docs": "https://conduit-v2.mintlify.app/errors#api-key-missing",
  "instance": "/v2/...",
  "correlationId": "00469ea4-52c1-4ffa-bd05-9f28b236a5fe",
  "timestamp": "2026-01-15T09:30:00.000Z"
}

{
  "type": "API_KEY_READ_ONLY",
  "title": "API Key Is Read-Only",
  "status": 403,
  "detail": "This API key has read-only access and cannot perform write operations. Read-only keys may make read requests (GET, HEAD, OPTIONS) only.",
  "resolution": "Use a read-write API key for this request, or have an organization admin mint one from the dashboard.",
  "docs": "https://conduit-v2.mintlify.app/errors#api-key-read-only",
  "instance": "/v2/...",
  "correlationId": "00469ea4-52c1-4ffa-bd05-9f28b236a5fe",
  "timestamp": "2026-01-15T09:30:00.000Z"
}

{
  "type": "FILE_TOO_LARGE",
  "title": "File Too Large",
  "status": 413,
  "detail": "The uploaded file exceeds the maximum allowed size (10 MB). The response carries an extra 'field' member naming the form-field that exceeded the limit (typically 'file').",
  "resolution": "Reduce the file size and re-upload. Multi-page PDFs that exceed the limit should be split into smaller files. High-resolution images may be downscaled or re-encoded with stronger compression.",
  "docs": "https://conduit-v2.mintlify.app/errors#file-too-large",
  "instance": "/v2/...",
  "correlationId": "00469ea4-52c1-4ffa-bd05-9f28b236a5fe",
  "timestamp": "2026-01-15T09:30:00.000Z"
}

{
  "type": "UNSUPPORTED_MEDIA_TYPE",
  "title": "Unsupported Media Type",
  "status": 415,
  "detail": "The request carries a body with a Content-Type this endpoint cannot parse. JSON endpoints accept 'application/json'; a body with no Content-Type header at all is assumed to be JSON. File-upload endpoints accept only 'multipart/form-data' — JSON or undeclared bodies are rejected there.",
  "resolution": "Send the request body with the 'Content-Type: application/json' header. For file uploads, use 'Content-Type: multipart/form-data' — upload endpoints accept no other body type.",
  "docs": "https://conduit-v2.mintlify.app/errors#unsupported-media-type",
  "instance": "/v2/...",
  "correlationId": "00469ea4-52c1-4ffa-bd05-9f28b236a5fe",
  "timestamp": "2026-01-15T09:30:00.000Z"
}

{
  "type": "RATE_LIMITED",
  "title": "Rate Limited",
  "status": 429,
  "detail": "Too many requests. This error is returned by three independent checks: the per-organization bucket applied to every authenticated API request; the per-IP bucket applied to unauthenticated traffic before an API key is validated; and the per-IP bucket applied when repeated invalid API keys are submitted from the same address. Honor the Retry-After header (also exposed as retryAfterSeconds in the body) before retrying. Current limits and remaining budget are visible in X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset on rate-limited route responses.",
  "resolution": "Sleep until Retry-After seconds have elapsed, then retry. For sustained workloads exceeding the per-organization defaults, request a rate-limit increase through your support contact.",
  "docs": "https://conduit-v2.mintlify.app/errors#rate-limited",
  "instance": "/v2/...",
  "correlationId": "00469ea4-52c1-4ffa-bd05-9f28b236a5fe",
  "timestamp": "2026-01-15T09:30:00.000Z",
  "retryAfterSeconds": 3
}

{
  "type": "INTERNAL_ERROR",
  "title": "Internal Error",
  "status": 500,
  "detail": "An unexpected error occurred while processing your request.",
  "resolution": "Retry the request after a brief delay. If the error persists, contact support and include the correlationId from the error response for investigation.",
  "docs": "https://conduit-v2.mintlify.app/errors#internal-error",
  "instance": "/v2/...",
  "correlationId": "00469ea4-52c1-4ffa-bd05-9f28b236a5fe",
  "timestamp": "2026-01-15T09:30:00.000Z"
}

Overview

Errors

Customers

Registered Addresses

Wallets

Wallet Signers

Signing Quorum

Virtual Accounts

Applications

RFIs

Documents

Verifications

Signing Requests

Transactions

Payouts

Whitelist Recipients

Orders

Asset Chain Pairs

Quotes

Webhook Endpoints

Webhook Deliveries

Webhook Event Types

Features

Customer Onboarding

Markup

Sandbox

Upload a document

Authorizations

Body

Response