---
title: "Upload compliance certificate"
method: POST
path: "/v1/trust-portal/compliance-resources/upload"
tags: ["Trust Portal"]
---

# Upload compliance certificate

`POST /v1/trust-portal/compliance-resources/upload`

## Request

- Base URL: `https://api.trycomp.ai`
- URL: `https://api.trycomp.ai/v1/trust-portal/compliance-resources/upload`
- Auth: API key in header `X-API-Key`

Upload or replace a compliance certificate PDF such as SOC 2, ISO 27001, HIPAA, or GDPR evidence for Trust Center sharing.

## Request body

- UploadComplianceResourceDto
  - `organizationId` string, required: Organization ID that owns the compliance resource
  - `framework` 'iso_27001' | 'iso_42001' | 'gdpr' | 'hipaa' | 'soc2_type1' | 'soc2_type2' | 'soc3' | 'pci_dss' | 'nen_7510' | 'iso_9001' | 'pipeda' | 'ccpa': Native compliance framework identifier
  - `customFrameworkId` string: Org-authored custom framework ID (alternative to `framework`)
  - `fileName` string, required: Original file name (PDF only)
  - `fileType` string, required: MIME type of the file
  - `fileData` string, required: Base64 encoded PDF content

## Response `201`

Compliance certificate uploaded successfully

- ComplianceResourceResponseDto
  - `framework` 'iso_27001' | 'iso_42001' | 'gdpr' | 'hipaa' | 'soc2_type1' | 'soc2_type2' | 'soc3' | 'pci_dss' | 'nen_7510' | 'iso_9001' | 'pipeda' | 'ccpa', nullable, required: Set for native-framework certificates; null for custom ones
  - `customFrameworkId` object, nullable, required: Set for custom-framework certificates; null for native ones
  - `fileName` string, required
  - `fileSize` number, required: File size in bytes
  - `updatedAt` string, required: ISO timestamp when the certificate was last updated

## Other responses

- `400`: Framework not compliant, PDF validation failed, or organization mismatch

## Changes

- **2026-06-11** `a87e7c0c5c25`: 1 breaking, 3 info
  - the response property `framework` became nullable for the status `201`
  - added the new optional request property `customFrameworkId`
  - the request property `framework` became optional
  - added the required property `customFrameworkId` to the response with the `201` status
- **2026-06-04** `d7d0199d846f`: 1 info
  - the endpoint scheme security `oauth2` was removed from the API
- **2026-05-29** `5382c53ab431`: 1 info
  - the endpoint scheme security `oauth2` was added to the API
- **2026-05-08** `4c7c42b20b90`: 2 warning, 2 info
  - added the new `ccpa` enum value to the `framework` response property for the response status `201`
  - added the new `pipeda` enum value to the `framework` response property for the response status `201`
  - added the new `ccpa` enum value to the request property `framework`
  - added the new `pipeda` enum value to the request property `framework`
- **2026-04-29** `ef13f9ae48ef`: 1 warning, 1 info
  - added the new `soc3` enum value to the `framework` response property for the response status `201`
  - added the new `soc3` enum value to the request property `framework`

[Operation history](https://skmtc.dev/trycompai/apis/comp-ai-api/changes/v1/trust-portal/compliance-resources/upload/post.md)

---

[API](https://skmtc.dev/trycompai/apis/comp-ai-api.md) - [All operations](https://skmtc.dev/trycompai/apis/comp-ai-api/llms.txt) - [OpenAPI document](https://skmtc.dev/trycompai/apis/comp-ai-api/revisions/194adff5164c?raw)