File
Upload a file
POST
Uploads one file (multipart/form-data). Reference the returned id (starts with file_) in other endpoints.
The signature's body digest is computed from the multipart fields; see Authentication.
- JPG, PNG and PDF only, detected from the file content rather than the extension; up to 10 MB.
- Only the merchant that uploaded a file can read and download it.
merchantApiKeymerchantTimestampmerchantNoncemerchantSignatureheader
X-API-KEY<token>Merchant API key (starts with upk_, also accepts api-key); signing headers are also required
header
X-Timestamp<token>Unix timestamp in seconds, within 300 seconds of server time
header
X-Nonce<token>Unique per request; cannot be reused with the same credential during the timestamp validity window
header
X-Signature<token>Hex HMAC-SHA256 signature (either letter case) of the method, full path, timestamp, nonce and body digest
multipart/form-data- body
file*fileFormat
binarypurpose?stringYour own purpose label, such as address_proof
Match
^[a-z0-9_]+$Length
length <= 64Saved
application/json- response
id*stringFile ID (starts with file_)
purpose*string|nullfilename*stringFile name at upload
mime_type*stringValue in
"image/jpeg""image/png""application/pdf"size*integerSize in bytes
sha256*stringcreated_at*stringFormat
date-timecurl -X POST 'https://sandbox.getupp.net/api/v1/upload' \ -F 'file=string'Example Response
{ "id": "file_01m5fdte1c89vjnxd3fetn4vg0", "purpose": "address_proof", "filename": "address-proof.jpg", "mime_type": "image/jpeg", "size": 2292, "sha256": "1a048adc931b528eaa64dab15521dc331ee2fa6e211e68d3ddd97c4db9eb02ca", "created_at": "2026-10-21T14:28:38.000000Z"}