---
title: "Upload a document for a company"
method: POST
path: "/core/latest/companies/{company-id}/documents"
tags: ["Company documents"]
---

# Upload a document for a company

`POST /core/latest/companies/{company-id}/documents`

## Request

- Base URL: `https://api.klara.ch`
- URL: `https://api.klara.ch/core/latest/companies/{company-id}/documents`
- Auth: one of:
  - API key in header `X-API-KEY`
  - HTTP bearer

Uploads a single file under one of a fixed set of document categories. The tenant is derived from the bearer token; only the authenticated company's id may be used in the path. Maximum file size: 25 MB. For category LIABILITY_UPLOAD the downstream service additionally triggers asynchronous AI analysis (the upload response is returned regardless of the AI outcome). Required caller roles (enforced by the downstream service): COMPANY_ADMINISTRATOR, TRUSTED_USER, ACCOUNTANT, CUSTOMER_RELATIONSHIP_MANAGER, EMPLOYEE or MYKLARA_USER.<br/><br/><strong>Important:</strong> When uploading documents as part of the <strong>create booking</strong> functionality only the <code>LIABILITY_UPLOAD</code> category is allowed (the documents are automatically moved to <code>LIABILITIES</code> when the booking is created successfully via <code>POST /core/v1/bookings</code>). The GUI implementation of booking creation must therefore always pass <code>LIABILITY_UPLOAD</code> as the <code>category</code> value in the request body.

## Path parameters

- `company-id` integer, required

## Response `200`

Document successfully uploaded.

- object
  - `documentId` string: Identifier of the stored document, assigned by the document service.

## Other responses

- `400`: Data invalid<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.
- `401`: No Authorization header found or invalid token<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.
- `403`: The current user is not allowed to access this company data<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.
- `413`: Uploaded file exceeds the 25 MB limit.<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.
- `415`: Unsupported Media Type<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.
- `429`: API rate limit exceeded<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.
- `500`: Something went wrong on our side while processing the request. Please kindly contact our support.<br/><br/>Failures detected by a downstream service carry that service's own <code>code</code>, which this reference does not enumerate, so the <code>code</code> field may hold a value not documented here. Treat an unrecognised code as a generic failure of the status it arrives with, and do not branch on a code this reference does not list.

---

[API](https://skmtc.dev/klara/apis/klara-public-api.md) · [All operations](https://skmtc.dev/klara/apis/klara-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/klara/apis/klara-public-api/revisions/490b1a879fc2?raw)