---
title: "Upload a document as raw bytes"
method: POST
path: "/api/v1/firme/source"
tags: ["Signatures (app routes)"]
---

# Upload a document as raw bytes

`POST /api/v1/firme/source`

## Request

- Base URL: `https://api.custodo.ai`
- URL: `https://api.custodo.ai/api/v1/firme/source`
- Auth: HTTP bearer

The first step of an envelope from a file of your own: the body IS the file (not multipart, not base64), up to 50 MB, with `filename` in the query. Answers its sha256, which `POST /api/v1/firme/envelopes` accepts as `sourceSha256` for each document. Non-PDF files force CAdES. Content-addressed, so a retry is harmless. A file already in the Archivio needs no upload: create with its `documentId`.

## Query parameters

- `filename` string, required

## Headers

- `X-Tenant-Id` string, uuid

## Response `201`

Staged.

- object
  - `ok` true, required
  - `data` FirmeStagedSource, required
    - `sha256` string, required: Pass it to `POST /api/v1/firme` as `sourceSha256`.
    - `filename` string, required
    - `sizeBytes` number, required
    - `contentType` string, required

## Other responses

- `400`: The request did not validate: `error.details` names the fields.
- `401`: No API key, or one that is malformed, unknown, revoked or expired.
- `403`: The module is off for this organisation, the credential lacks the permission, or the tier does not cover it.
- `409`: Storage is not configured on this deploy.
- `413`: Over 50 MB.
- `429`: The API key has spent its minute, or its day. See `Retry-After`.

---

[API](https://skmtc.dev/custodo/apis/custodo-integrazioni.md) · [All operations](https://skmtc.dev/custodo/apis/custodo-integrazioni/llms.txt) · [OpenAPI document](https://skmtc.dev/custodo/apis/custodo-integrazioni/revisions/16d336d3ec2a?raw)