---
title: "Upload a document to a vehicle"
method: POST
path: "/v1/vehicles/{id}/documents"
tags: ["Vehicles"]
---

# Upload a document to a vehicle

`POST /v1/vehicles/{id}/documents`

## Request

- Base URL: `https://api.officina.it`
- URL: `https://api.officina.it/v1/vehicles/{id}/documents`
- Auth: HTTP bearer

`multipart/form-data` — mirrors the customer document upload:
part `file` (required, max 25MB) and field `description`
(display label; the app requires it, the server falls back to
the file name — web form parity). Storage layout matches the
web upload, so documents from either surface are identical.

## Response `201`

The stored document.

- VehicleDocument: One attachment on a vehicle (Documenti Allegati). `url` is the authenticated download route — fetch it with the bearer and hand the bytes to the OS viewer/share sheet.
  - `object` 'vehicle_document', required
  - `id` string, required
  - `name` string, required: Original file name.
  - `content_type` string, required
  - `description` string, nullable, required
  - `url` string, required
  - `file_size_bytes` integer, required
  - `created_at` string, date-time, required

## Other responses

- `401`: Missing, malformed, expired, or wrong-audience bearer token.
- `402`: The company has no active subscription, or its plan does not include API access. API access is included in the Business and Illimitato plans.
- `403`: The authenticated user lacks the required permission.
- `404`: Resource does not exist OR belongs to a different company. The two cases are intentionally indistinguishable.
- `422`: A request field is missing or invalid (fast-fail).
- `500`: Unhandled server error. Detail is logged, not exposed.

---

[API](https://skmtc.dev/officina/apis/officina-it-api.md) · [All operations](https://skmtc.dev/officina/apis/officina-it-api/llms.txt) · [OpenAPI document](https://skmtc.dev/officina/apis/officina-it-api/revisions/7da3fccfe551?raw)