---
title: "Upload a document"
method: POST
path: "/v2/documents"
---

# Upload a document

`POST /v2/documents`

## Request

- Base URL: `https://api.slash.com`
- URL: `https://api.slash.com/v2/documents`
- Auth: API key in header `X-API-Key`

Upload a PDF, PNG or JPEG of up to 25 MB as `multipart/form-data`.

## Request body `multipart/form-data`

- object
  - `purpose` 'bill_invoice' | 'accounting_receipt' | 'invoice_logo', required: What the file is for: `bill_invoice` for bills, `accounting_receipt` for accounting entries, `invoice_logo` for invoice settings. Send it before `file`.
  - `file` string, binary: The file to upload. PDF, PNG, or JPEG, and only PNG or JPEG for `invoice_logo` (HEIC is converted to JPEG). Required; a request without a `file` part is rejected with `file_required`.

## Response `200`

The uploaded document, with a `downloadUrl` for the stored file.

- Document: A file stored on Slash, uploaded through the API or generated by Slash. Attach it by id where its `purpose` is accepted; the file itself is fetched through `downloadUrl`.
  - `id` string, required: Document id with the `st_` prefix.
  - `filename` string, required: The filename supplied at upload.
  - `purpose` 'bill_invoice' | 'accounting_receipt' | 'invoice_logo': What the document was uploaded for. Absent on files Slash generated.
  - `contentType` string, required: MIME type detected from the file's bytes.
  - `sizeBytes` integer, required: Size of the stored file in bytes, or `0` for files Slash generated.
  - `downloadUrl` string, uri, required: Presigned URL for the file. Valid for about 15 minutes; fetch the document again for a fresh one.
  - `createdAt` string, date-time, required: When the document was uploaded.

## Other responses

- `400`: - `file_required` — The `multipart/form-data` body ended without a `file` part. - `file_too_large` — Files can be up to 25 MB, and invoice logos up to 2 MB. - `pdf_too_many_pages` — PDFs can have up to 100 pages. - `unreadable_pdf` — The file is not a valid PDF, or it is damaged or encrypted. - `unsupported_file_type` — Only PDF, PNG and JPEG files are accepted, and only PNG and JPEG for invoice logos. HEIC photos are converted to JPEG on upload. - `invalid_request (request shape)` — The body, query, or headers failed validation, or a required header is missing. `details` has one entry per failing location, keyed by JSON pointer or header name.
- `401`: - `unauthorized` — API key authentication is missing or invalid.
- `403`: - `forbidden` — The credential is not permitted to perform this action on the resource. When the resource is a field of the request, `details` names that `field` and the `id` it received. - `forbidden (legal entity)` — The credential is not permitted to act for the selected legal entity. - `not_available` — Public API v2 is not yet available. Use [Public API v1](https://docs.slash.com/introduction) in the meantime. - `user_api_key_required` — The API key is scoped to a legal entity rather than a user. Every v2 request needs a user API key, created under Settings → API keys in the Slash dashboard, together with the `x-legal-entity` header.
- `429`: The request exceeded the applicable rate limit. The response body is plain text, not the error object; clients must not depend on its wording.
- `500`: - `internal` — Slash could not complete the request. Quote `referenceId` when contacting Slash support.

## Changes

- **2026-10-16** `8b5d371ffeea`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/slashfi/apis/slash-public-api/changes/v2/documents/post.md)

---

[API](https://skmtc.dev/slashfi/apis/slash-public-api.md) - [All operations](https://skmtc.dev/slashfi/apis/slash-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/slashfi/apis/slash-public-api/revisions/eaed2d63c9e2?raw)