---
title: "Attach Submission Resume"
method: PATCH
path: "/api/forms/submission/{candidate_id}/resume"
tags: ["Forms"]
---

# Attach Submission Resume

`PATCH /api/forms/submission/{candidate_id}/resume`

## Request

- Base URL: `https://api.ruzora.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.ruzora.com/api/forms/submission/{candidate_id}/resume`
- Auth: none declared

Attach an uploaded résumé to a just-created application (Epic 2.6).

The public form now runs: POST /submission (row exists, emails + auto-
send queued) → POST /upload-resume → PATCH here. This endpoint is the
ONLY place the www apply path triggers the résumé parse.

Guard: the submission response's ``resume_upload_token`` (HMAC of
candidate_id + issue time, 1 hour). A bare id is never enough —
401 when the token is missing, 403 when it is forged, for another
candidate, or expired. Re-sending a valid token within the hour is
allowed (the UI's retry path): each call adds a resume document and
re-queues the parse; the newest document wins.

## Path parameters

- `candidate_id` string, required

## Request body

- ResumeAttachRequest: Body of PATCH /api/forms/submission/{candidate_id}/resume.
  - `resume_url` string, required
  - `resume_upload_token` string, required
  - `filename` string, nullable

## Response `200`

Successful Response

- ResumeAttachResponse
  - `success` boolean, required
  - `candidate_id` string, required
  - `document_id` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ruzora/apis/ruzora-candidate-crm-api.md) · [All operations](https://skmtc.dev/ruzora/apis/ruzora-candidate-crm-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ruzora/apis/ruzora-candidate-crm-api/revisions/f9b8223f3ac4?raw)