---
title: "Upload candidate file"
method: POST
path: "/candidates/{id}/files"
tags: ["Candidates"]
---

# Upload candidate file

`POST /candidates/{id}/files`

## Request

- Base URL: `https://api.100hires.com/v2`
- URL: `https://api.100hires.com/v2/candidates/{id}/files`
- Auth: HTTP bearer

Uploads a new file for a candidate using base64 payload. Useful for resume ingestion, portfolio uploads, and post-processing pipelines.

## Path parameters

- `id` string, required

## Request body

- CandidateFileUploadRequest
  - `file` FileData, required
    - `data` string, required: Base64 content
    - `file_name` string, required: Original file name.
    - `mime_type` string, required: MIME type (e.g. application/pdf).
    - `size` integer: Optional for uploads, returned in responses

## Response `200`

Uploaded file

- CandidateFile: Unified attachment shape returned by apiV2 endpoints (resumes, candidate files, application attachments, message attachments, call recordings, voicemail audio in nurture campaigns). `url` is an absolute URL served by the API host (`https://api.100hires.com/v2/attachments/{category}/{uuid}/{file_name}`) and serves the raw file bytes with `Authorization: Bearer <API_KEY>`. The response on `url` sets `Content-Disposition: attachment; filename="..."` with the human-readable filename. Use `uuid` to reference the attachment in other endpoints (e.g. nurture voicemail step).
  - `uuid` string, uuid, required: Unique attachment identifier. Stable across API calls; use in referencing endpoints.
  - `url` string, uri, nullable, required: Absolute download URL (e.g. `https://api.100hires.com/v2/attachments/application/{uuid}/{file_name}`). Hit with `Authorization: Bearer <API_KEY>`.
  - `relative_time` string, required: Human-readable time since upload (e.g. `"2 days ago"`).
  - `file` AttachmentFile, required
    - `is_image` boolean, nullable, required: Whether the file is an image.
    - `orig_file_name` string, required: Original file name.
    - `file_ext` string, required: File extension.
    - `file_type` string, required: File type category.
    - `readable_size` string, required: Human-readable file size.

## Other responses

- `400`: Validation error
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `415`: Content-Type must be application/json
- `429`: Too many requests

---

[API](https://skmtc.dev/100hires/apis/100hires-api.md) · [All operations](https://skmtc.dev/100hires/apis/100hires-api/llms.txt) · [OpenAPI document](https://skmtc.dev/100hires/apis/100hires-api/revisions/e63e2d3115f7?raw)