Skip to main content
POST
Upload evidence form file

Authorizations

X-API-Key
string
header
required

API key for authentication

Headers

X-Organization-Id
string

Organization ID (required for session auth, optional for API key auth)

Body

application/json

A file for one file field of a form. Provide exactly one of fileData or s3Key. Returns the {fileName, fileKey, downloadUrl} object to put under that field key when submitting.

formType
enum<string>
required

Form the file belongs to.

Available options:
board-meeting,
it-leadership-meeting,
risk-committee-meeting,
meeting,
access-request,
whistleblower-report,
penetration-test,
rbac-matrix,
infrastructure-inventory,
employee-performance-evaluation,
network-diagram,
tabletop-exercise,
account-types
fileName
string
required

Original file name, stored for display and download.

Example:

"network_diagram.png"

fileType
string
required

MIME type of the file.

Example:

"image/png"

fileData
string

Base64-encoded file contents, for the web UI and direct callers. AI/MCP clients should upload via /v1/uploads/presign (purpose=evidence) and pass s3Key instead.

Example:

"iVBORw0KGgo="

s3Key
string

Key of a file already uploaded via /v1/uploads/presign (purpose=evidence). The server reads the bytes from storage, so no base64 travels through the client.

Example:

"org_abc123/uploads/evidence/1735000000000-network_diagram.png"

Response

201 - undefined