Mint an upload token

POST/documents/upload-token

Step 1 of the canonical upload pair. Returns a presigned PUT url and the storage key to echo back to the register endpoint. The client PUTs the bytes straight to S3 — they never transit the API.

The key is namespaced to your organisation (api-suite/{organisationId}/...). Echo it back verbatim: the register endpoint only accepts keys minted for the calling organisation, so an arbitrary object key in the bucket cannot be registered and then downloaded.

Request body

application/json, required

uploadTypestringRequired#
Logical upload category (audit/back-compat).
objectNamestringRequired#
Original filename; its extension shapes the key.

{
  "uploadType": "document",
  "objectName": "term-sheet.pdf"
}

Responses

201

Created

UploadToken

{
  "data": {
    "key": "api-suite/42/5e6f7081-92a3-4b4c-9d6e-7f8091a2b3c4.pdf",
    "url": "https://files.example-cdn.com/uploads/api-suite/42/5e6f7081-92a3-4b4c-9d6e-7f8091a2b3c4.pdf?signature=abc123&expires=1781000000",
    "expires_at": "2026-06-15T11:30:00+00:00"
  }
}

401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error

403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error

422

Request validation failed (HTTP 422). The body is either the Laravel validation envelope (message + field-keyed errors) or the API error envelope for domain rejections (e.g. form_type_not_supported, folder_locked, parent_not_found, folder_not_empty).

429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/documents/upload-token\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "uploadType": "document",
  "objectName": "term-sheet.pdf"
}'