Documents

Upload a document

POST/folders/{folderId}/documents
documents:writeupload_documentDeprecatedSunset 2027-06-30

Uploads one file (multipart/form-data, field file) into the folder and returns the document. An unreadable or hidden folder returns 404 (the successor accepts hidden folders), an unwritable one 403 forbidden, a locked one 409 conflict. A used name is numbered, e.g. a(1).pdf. dry_run returns 422. Emits document.created after commit; no email. Can't be undone here. Deprecated: use POST /documents with multipart/form-data. Withdrawn on 2027-06-30. Responses carry Deprecation, Sunset and a successor Link.

Path parameters

  • folderIdstring (uuid)Required#

    The folder's public uuid.

Request body

multipart/form-data, required

  • filestring (binary)Required#

    The file to upload.

Responses

201

Created

LegacyDocument
{
  "data": {
    "id": "5e6f7081-92a3-4b4c-9d6e-7f8091a2b3c4",
    "name": "signed-agreement.pdf",
    "folder_id": "071829a3-4b5c-4d6e-8f90-1a2b3c4d5e6f",
    "size": 1048576,
    "mime_type": "application/pdf",
    "created_at": "2026-06-15T10:30:00+00:00"
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error
404

Resource not found (error.code = not_found).

Error
409

The request conflicts with existing state (error.code = conflict), e.g. a compliance flow with the requested name already exists.

Error
422

Request validation failed (HTTP 422). The body is either the Laravel validation envelope (message + field-keyed errors) or the API error envelope for domain rejections (e.g. form_type_not_supported, folder_locked, parent_not_found, folder_not_empty).

429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/folders/{folderId}/documents\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"