---
title: "Upload a document"
method: POST
path: "/v1/customers/{id}/documents"
tags: ["Customers"]
---

# Upload a document

`POST /v1/customers/{id}/documents`

## Request

- Base URL: `https://api.officina.it`
- URL: `https://api.officina.it/v1/customers/{id}/documents`
- Auth: HTTP bearer

Attaches a file to the customer — the one multipart write on this
API (`Content-Type: multipart/form-data`). Storage layout matches
the web upload, so documents from either surface are identical.
Max 25MB.

## Response `201`

The stored document (url = its download route).

- CustomerDocument: One customer attachment. `url` is the document's authenticated download route (`/v1/customers/{id}/documents/{documentID}/download`) — fetch it with the bearer to stream the bytes.
  - `object` 'customer_document', required
  - `id` string, required
  - `name` string, required
  - `content_type` string, required
  - `description` string, nullable
  - `url` string, required
  - `file_size_bytes` integer, required
  - `created_at` string, date-time, required

## Other responses

- `401`: Missing, malformed, expired, or wrong-audience bearer token.
- `402`: The company has no active subscription, or its plan does not include API access. API access is included in the Business and Illimitato plans.
- `403`: The authenticated user lacks the required permission.
- `404`: Resource does not exist OR belongs to a different company. The two cases are intentionally indistinguishable.
- `415`: Content-Type is not `application/json`, or Accept rejects JSON.
- `422`: A request field is missing or invalid (fast-fail).
- `500`: Unhandled server error. Detail is logged, not exposed.

---

[API](https://skmtc.dev/officina/apis/officina-it-api.md) · [All operations](https://skmtc.dev/officina/apis/officina-it-api/llms.txt) · [OpenAPI document](https://skmtc.dev/officina/apis/officina-it-api/revisions/7da3fccfe551?raw)