/application/document/uploadUpload Document
Uploads a document for an application. Send the file as raw binary in the request body with the appropriate Content-Type header.
The DocumentType value for the type query parameter is found in Documents[].DocumentType from GET /application/detail/{id}. For individual-level documents, include uboId (the individual_id field from the document action item).
Postman setup: Body → binary → select local file. Enable Content-Type header matching the file type.
Query parameters
| Field | Type | Required | Possible values | Description |
|---|---|---|---|---|
formId | string | Required | — | Application form ID (same as `ApplicationId`). |
type | string | Required | SourceOfFunds | BusinessTaxIdProof | Business_Proof_Address | SourceOfBusFundsProof | ProofOfAddress | Document type from the action item (e.g. `SourceOfFunds`, `BusinessTaxIdProof`, `ProofOfAddress`, `Business_Proof_Address`, `SourceOfBusFundsProof`). Copy from `Documents[].DocumentType` in GET /application/detail. |
uboId | string | Optional | — | Individual ID — required for individual-level documents. Found in `Documents[].individual_id` from GET /application/detail. Omit for business-level documents. |
fileName | string | Optional | e.g. document.pdf | Filename with extension (e.g. `passport.pdf`). |
Headers
| Field | Type | Required | Possible values | Description |
|---|---|---|---|---|
session-token | string | Required | — | Session token from authentication. |
Content-Type | string | Required | application/pdf | image/png | image/jpeg | MIME type of the file being uploaded. Must match the actual file content. |
Request body
| Field | Type | Required | Possible values | Description |
|---|---|---|---|---|
file | file | Required | File (PDF, PNG, JPG) | Binary file to upload. Send as raw request body — not base64, not multipart. Supported formats: PDF, PNG, JPEG. Max 10 MB. |
Response
| Field | Type | Possible values | Description |
|---|---|---|---|
ResponseCode | integer | 200 | 201 | 204 | 301 | 400 | 401 | 403 | 404 | 410 | 422 | 500 | 503 | API result code in the response envelope. Indicates success or the error category (e.g. 200 success, 400 bad request, 401 unauthorized). |
ResponseMessage | string | Success | Created | NoContent | BadRequest | Unauthorized | Forbidden | NotFound | Gone | UnprocessableContent | ServerError | ResourceMoved | ServiceUnAvailable | UnProcessableEntity | Human-readable label paired with ResponseCode (e.g. Success, BadRequest, Unauthorized). Use with ResponseCode to interpret the outcome. |
ResponseData | object | Please refer to below example for response body | Uploaded document record. `Ubo_id` is present for individual-level documents (when `uboId` query param is provided). `FlowStatus: 1` = submitted. `Attachment.Urls[].Key` is the signed URL path to access the uploaded file. |
Example response
{
"ResponseCode": 200,
"ResponseMessage": "Success",
"ResponseData": {
"Version": 1,
"ApplicationId": "6a47694f5f39cb7aee21f10e",
"Ubo_id": "6a4765ff5f39cb7aee21f106",
"Seq": 1,
"Type": "SourceOfFunds",
"Attachment": {
"Urls": [
{
"Key": "/api/o/assets/j/eyJhbGci..."
}
],
"Time": 1783064911
},
"FlowStatus": 1,
"Source": 0,
"Form_id": "6a4763a25f39cb7aee21f0e3",
"CreatedAt": 1783064911,
"UpdatedAt": 1783064911
}
}Query parameter names are lowercase (`formId`, `type`, `uboId`). Maximum file size: 10 MB. Supported formats: `application/pdf`, `image/png`, `image/jpeg`.
ℹ Note
A 423 Application Locked response is returned when the application is in a locked or final status. No further modifications are permitted until FV Bank unlocks the application.
ℹ Note
On 400 validation errors, each error in ResponseErrors includes a Field property that identifies the failing PascalCase request body field (e.g. Business.Phone, Email, Address.City). Use this to surface precise field-level error messages in your UI.
Requires `session-token: {SessionToken}` from Create GMA Session. Use the same client IP as authentication.