> This is Payabli documentation. For a complete page index, fetch https://docs.payabli.com/llms.txt — append .md to any page URL for lightweight markdown. For section-level indexes, query parameters, and other AI-optimized access methods, see https://docs.payabli.com/ai-agents.md

# Upload an application document

POST https://api-sandbox.payabli.com/api/v2/requests/{requestsReference}/documents
Content-Type: multipart/form-data

Uploads one document to an application as multipart form data. [List the application's document requirements](/developers/api-reference/applications/list-application-document-requirements) first. Send the requirement's `fieldPath`, one of its `subjectTypes` as `subject`, and, for a person requirement, its `personReference`.

The file can be up to 10 MB, in a format the requirement accepts. Payabli checks the file's content, not only its name. Each requirement takes up to `maxUploads` documents.

Uploading doesn't change the application's status. When underwriting requests documents, upload them, then call [provide documents](/developers/api-reference/applications/provide-application-documents) to return the application to review.


Reference: https://docs.payabli.com/developers/api-reference/applications/upload-an-application-document

## Authentication

- `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer <token>`, where token is your auth token.

## Servers

- `https://api-sandbox.payabli.com/api` (Sandbox, default)
- `https://api.payabli.com/api` (Production)

## Request

### Path parameters

- `requestsReference` (string, required) — The application reference.

### Body (multipart/form-data)

This endpoint expects a multipart form containing a file.

- `file` (file, required) — The file to upload, up to 10 MB. Payabli checks the file's content, not only its name, against the requirement's `allowedFormats`.
- `fieldPath` (string, required) — The `fieldPath` of the requirement you're uploading for, from [List application document requirements](/developers/api-reference/applications/list-application-document-requirements).
- `subject` (enum, required) — The record the document is about. Send one of the requirement's `subjectTypes`.
- `personReference` (string, optional) — The person the document is about. Required when `subject` is `person`. Use the `personReference` from the person's requirement.

## Response

### 201

The document was uploaded.

- `success` (boolean, required) — Whether the request succeeded.
- `message` (string, required, nullable) — A human-readable result message.
- `traceId` (string, required, nullable) — The trace identifier for the request, useful for support.
- `data` (ApplicationDocument, required) — A document uploaded to an application.

## Errors

### 400 Bad Request Error

The upload is invalid. For example, `fieldPath` and `personReference` don't match a requirement, the file is empty, over 10 MB, or in a format the requirement doesn't accept, or the requirement already has `maxUploads` documents.

- `success` (boolean, required) — Whether the request succeeded. Always `false`.
- `error` (string, required) — The error code, such as `VALIDATION_ERROR` or `NOT_FOUND`.
- `message` (string, required) — A human-readable description of the error.
- `traceId` (string, required, nullable) — The trace identifier for the request, useful for support.

### 401 Unauthorized Error

Unauthorized request.

- `isSuccess` (boolean, required) — Always `false` for error responses.
- `responseText` (string, required) — Error text describing what went wrong.
- `responseCode` (integer, optional) — Code for the response. Learn more in [API Response Codes](/developers/api-reference/api-responses).
- `responseData` (PayabliErrorBodyResponseData, optional) — Object with detailed error context.

### 404 Not Found Error

The application doesn't exist.

- `success` (boolean, required) — Whether the request succeeded. Always `false`.
- `error` (string, required) — The error code, such as `VALIDATION_ERROR` or `NOT_FOUND`.
- `message` (string, required) — A human-readable description of the error.
- `traceId` (string, required, nullable) — The trace identifier for the request, useful for support.

### 500 Internal Server Error

Internal server error.

- `isSuccess` (boolean, required) — Always `false` for error responses.
- `responseText` (string, required) — Error text describing what went wrong.
- `responseCode` (integer, optional) — Code for the response. Learn more in [API Response Codes](/developers/api-reference/api-responses).
- `responseData` (PayabliErrorBodyResponseData, optional) — Object with detailed error context.

## Types

### ApplicationDocument

A document uploaded to an application.

- `documentReference` (string, required) — The document reference. Use it to delete the document.
- `kind` (string, required) — How the document was added to the application. Documents you upload are `applicantUpload`.
- `subjectType` (enum, required) — The record the document is about.
  - Allowed values: `business`, `paypoint`, `person`
- `personReference` (string, required, nullable) — The person the document is about, when `subjectType` is `person`. Otherwise, `null`.
- `fieldPath` (string, required) — The requirement the document was uploaded for.
- `fileName` (string, required) — The name of the uploaded file.
- `mimeType` (string, required) — The file's media type, such as `application/pdf`.
- `fileSizeBytes` (long, required) — The file's size, in bytes.
- `uploadedAt` (datetime, required) — When the document was uploaded.

### PayabliErrorBodyResponseData

Object with detailed error context.

- `explanation` (string, optional) — Human-readable explanation of what happened.
- `todoAction` (string, optional) — Suggested resolution.

## Examples

### UploadApplicationDocument

**Request**

```json
{
  "fieldPath": "documents.bankStatement",
  "file": "<file: <file1>>",
  "subject": "business"
}
```

**Response**

```json
{
  "success": true,
  "message": "Document uploaded successfully",
  "traceId": "0HNPA847I395C:00000013",
  "data": {
    "documentReference": "019ff1d7-5c2e-7a41-9b3d-2f6e8c1a4d90",
    "kind": "applicantUpload",
    "subjectType": "business",
    "personReference": null,
    "fieldPath": "documents.bankStatement",
    "fileName": "bank-statement-september.pdf",
    "mimeType": "application/pdf",
    "fileSizeBytes": 482113,
    "uploadedAt": "2026-10-16T13:20:22.8767892Z"
  }
}
```

**SDK Code**

```python UploadApplicationDocument
import requests

url = "https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents"

files = { "file": "open('<file1>', 'rb')" }
payload = {
    "fieldPath": "documents.bankStatement",
    "personReference": ,
    "subject": "business"
}
headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, data=payload, files=files, headers=headers)

print(response.json())
```

```javascript UploadApplicationDocument
const url = 'https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents';
const form = new FormData();
form.append('fieldPath', 'documents.bankStatement');
form.append('file', '<file1>');
form.append('personReference', '');
form.append('subject', 'business');

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

options.body = form;

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go UploadApplicationDocument
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents"

	payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"fieldPath\"\r\n\r\ndocuments.bankStatement\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"<file1>\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"personReference\"\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"subject\"\r\n\r\nbusiness\r\n-----011000010111000001101001--\r\n")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby UploadApplicationDocument
require 'uri'
require 'net/http'

url = URI("https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"fieldPath\"\r\n\r\ndocuments.bankStatement\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"<file1>\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"personReference\"\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"subject\"\r\n\r\nbusiness\r\n-----011000010111000001101001--\r\n"

response = http.request(request)
puts response.read_body
```

```java UploadApplicationDocument
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents")
  .header("Authorization", "Bearer <token>")
  .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"fieldPath\"\r\n\r\ndocuments.bankStatement\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"<file1>\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"personReference\"\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"subject\"\r\n\r\nbusiness\r\n-----011000010111000001101001--\r\n")
  .asString();
```

```php UploadApplicationDocument
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents', [
  'multipart' => [
    [
        'name' => 'fieldPath',
        'contents' => 'documents.bankStatement'
    ],
    [
        'name' => 'file',
        'filename' => '<file1>',
        'contents' => null
    ],
    [
        'name' => 'subject',
        'contents' => 'business'
    ]
  ]
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp UploadApplicationDocument
using RestSharp;

var client = new RestClient("https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
request.AddParameter("undefined", "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"fieldPath\"\r\n\r\ndocuments.bankStatement\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"<file1>\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"personReference\"\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"subject\"\r\n\r\nbusiness\r\n-----011000010111000001101001--\r\n", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift UploadApplicationDocument
import Foundation

let headers = ["Authorization": "Bearer <token>"]
let parameters = [
  [
    "name": "fieldPath",
    "value": "documents.bankStatement"
  ],
  [
    "name": "file",
    "fileName": "<file1>"
  ],
  [
    "name": "personReference",
    "value": 
  ],
  [
    "name": "subject",
    "value": "business"
  ]
]

let boundary = "---011000010111000001101001"

var body = ""
var error: NSError? = nil
for param in parameters {
  let paramName = param["name"]!
  body += "--\(boundary)\r\n"
  body += "Content-Disposition:form-data; name=\"\(paramName)\""
  if let filename = param["fileName"] {
    let contentType = param["content-type"]!
    let fileContent = String(contentsOfFile: filename, encoding: String.Encoding.utf8)
    if (error != nil) {
      print(error as Any)
    }
    body += "; filename=\"\(filename)\"\r\n"
    body += "Content-Type: \(contentType)\r\n\r\n"
    body += fileContent
  } else if let paramValue = param["value"] {
    body += "\r\n\r\n\(paramValue)"
  }
}

let request = NSMutableURLRequest(url: NSURL(string: "https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### UploadPersonDocument

**Request**

```json
{
  "fieldPath": "person.documents.w9",
  "file": "<file: <file1>>",
  "personReference": "01a0014d-ce1a-7110-9bac-c4c59647a88d",
  "subject": "person"
}
```

**Response**

```json
{
  "success": true,
  "message": "Document uploaded successfully",
  "traceId": "0HNPA847I3963:0000002B",
  "data": {
    "documentReference": "019ff1d7-6e14-7c8b-a2f5-91d3b7e04c62",
    "kind": "applicantUpload",
    "subjectType": "person",
    "personReference": "01a0014d-ce1a-7110-9bac-c4c59647a88d",
    "fieldPath": "person.documents.w9",
    "fileName": "w9-marcus-delgado.pdf",
    "mimeType": "application/pdf",
    "fileSizeBytes": 96270,
    "uploadedAt": "2026-10-16T13:34:51.3779Z"
  }
}
```

**SDK Code**

```python UploadPersonDocument
import requests

url = "https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents"

files = { "file": "open('<file1>', 'rb')" }
payload = {
    "fieldPath": "person.documents.w9",
    "personReference": "01a0014d-ce1a-7110-9bac-c4c59647a88d",
    "subject": "person"
}
headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, data=payload, files=files, headers=headers)

print(response.json())
```

```javascript UploadPersonDocument
const url = 'https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents';
const form = new FormData();
form.append('fieldPath', 'person.documents.w9');
form.append('file', '<file1>');
form.append('personReference', '01a0014d-ce1a-7110-9bac-c4c59647a88d');
form.append('subject', 'person');

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

options.body = form;

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go UploadPersonDocument
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents"

	payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"fieldPath\"\r\n\r\nperson.documents.w9\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"<file1>\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"personReference\"\r\n\r\n01a0014d-ce1a-7110-9bac-c4c59647a88d\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"subject\"\r\n\r\nperson\r\n-----011000010111000001101001--\r\n")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby UploadPersonDocument
require 'uri'
require 'net/http'

url = URI("https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"fieldPath\"\r\n\r\nperson.documents.w9\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"<file1>\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"personReference\"\r\n\r\n01a0014d-ce1a-7110-9bac-c4c59647a88d\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"subject\"\r\n\r\nperson\r\n-----011000010111000001101001--\r\n"

response = http.request(request)
puts response.read_body
```

```java UploadPersonDocument
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents")
  .header("Authorization", "Bearer <token>")
  .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"fieldPath\"\r\n\r\nperson.documents.w9\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"<file1>\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"personReference\"\r\n\r\n01a0014d-ce1a-7110-9bac-c4c59647a88d\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"subject\"\r\n\r\nperson\r\n-----011000010111000001101001--\r\n")
  .asString();
```

```php UploadPersonDocument
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents', [
  'multipart' => [
    [
        'name' => 'fieldPath',
        'contents' => 'person.documents.w9'
    ],
    [
        'name' => 'file',
        'filename' => '<file1>',
        'contents' => null
    ],
    [
        'name' => 'personReference',
        'contents' => '01a0014d-ce1a-7110-9bac-c4c59647a88d'
    ],
    [
        'name' => 'subject',
        'contents' => 'person'
    ]
  ]
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp UploadPersonDocument
using RestSharp;

var client = new RestClient("https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
request.AddParameter("undefined", "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"fieldPath\"\r\n\r\nperson.documents.w9\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"<file1>\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"personReference\"\r\n\r\n01a0014d-ce1a-7110-9bac-c4c59647a88d\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"subject\"\r\n\r\nperson\r\n-----011000010111000001101001--\r\n", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift UploadPersonDocument
import Foundation

let headers = ["Authorization": "Bearer <token>"]
let parameters = [
  [
    "name": "fieldPath",
    "value": "person.documents.w9"
  ],
  [
    "name": "file",
    "fileName": "<file1>"
  ],
  [
    "name": "personReference",
    "value": "01a0014d-ce1a-7110-9bac-c4c59647a88d"
  ],
  [
    "name": "subject",
    "value": "person"
  ]
]

let boundary = "---011000010111000001101001"

var body = ""
var error: NSError? = nil
for param in parameters {
  let paramName = param["name"]!
  body += "--\(boundary)\r\n"
  body += "Content-Disposition:form-data; name=\"\(paramName)\""
  if let filename = param["fileName"] {
    let contentType = param["content-type"]!
    let fileContent = String(contentsOfFile: filename, encoding: String.Encoding.utf8)
    if (error != nil) {
      print(error as Any)
    }
    body += "; filename=\"\(filename)\"\r\n"
    body += "Content-Type: \(contentType)\r\n\r\n"
    body += fileContent
  } else if let paramValue = param["value"] {
    body += "\r\n\r\n\(paramValue)"
  }
}

let request = NSMutableURLRequest(url: NSURL(string: "https://api-sandbox.payabli.com/api/v2/requests/3f3caa7b-bdfe-4bf1-814b-30d54859247c/documents")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```