POST/v2/application/document/upload

Upload Document

Uploads a document for an application. Send the file as raw binary in the request body, with a Content-Type that matches the file. Documents flagged needForFormExtraction are read automatically and used to pre-fill the form.

Query parameters

Field	Type	Required	Possible values	Description
`applicationId`	string	Required	—	Application ID.
`type`	string	Required	SourceOfFunds \| BusinessTaxIdProof \| Business_Proof_Address \| SourceOfBusFundsProof \| ProofOfAddress	Document type from the action item (e.g. `SourceOfFunds`, `BusinessTaxIdProof`, `ProofOfAddress`, `Business_Proof_Address`, `SourceOfBusFundsProof`). Copy from `Documents[].DocumentType` in the application detail response.
`individualId`	string	Optional	—	Individual ID — required for individual-level documents. Found in `Documents[].IndividualId` from the application detail response. Omit for business-level documents.
`fileName`	string	Optional	e.g. document.pdf	Filename with extension (e.g. `passport.pdf`).

Headers

Field	Type	Required	Possible values	Description
`session-token`	string	Required	—	Session token from authentication.
`Content-Type`	string	Required	application/pdf \| image/png \| image/jpeg	MIME type of the file being uploaded. Must match the actual file content.

Request body

Field	Type	Required	Possible values	Description
`file`	file	Required	File (PDF, PNG, JPG)	Binary file to upload. Send as raw request body — not base64, not multipart. Supported formats: PDF, PNG, JPEG. Max 10 MB.

Response

Field	Type	Possible values	Description
`ResponseCode`	integer	200 \| 201 \| 204 \| 301 \| 400 \| 401 \| 403 \| 404 \| 410 \| 422 \| 500 \| 503	API result code in the response envelope. Indicates success or the error category (e.g. 200 success, 400 bad request, 401 unauthorized).
`ResponseMessage`	string	Success \| Created \| NoContent \| BadRequest \| Unauthorized \| Forbidden \| NotFound \| Gone \| UnprocessableContent \| ServerError \| ResourceMoved \| ServiceUnAvailable \| UnProcessableEntity	Human-readable label paired with ResponseCode (e.g. Success, BadRequest, Unauthorized). Use with ResponseCode to interpret the outcome.
`ResponseData`	object	Please refer to below example for response body	Uploaded document record. `ApplicationId` is the application. `IndividualId` is present for an individual document. `DocCategoryId` and `ErrorMessage` are included when set. `FlowStatus: 1` = submitted. `Attachment.Urls[].Key` is the signed URL path to access the uploaded file.

Example response

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "Version": 1,
    "ApplicationId": "6a47694f5f39cb7aee21f10e",
    "IndividualId": "6a4765ff5f39cb7aee21f106",
    "Seq": 1,
    "Type": "SourceOfFunds",
    "Attachment": {
      "Urls": [
        {
          "Key": "/api/o/assets/j/eyJhbGci..."
        }
      ],
      "Time": 1783064911
    },
    "FlowStatus": 1,
    "Source": 0,
    "DocCategoryId": "6a4765ff5f39cb7aee21f107",
    "ErrorMessage": null,
    "CreatedAt": 1783064911,
    "UpdatedAt": 1783064911
  }
}

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "Version": 1,
    "ApplicationId": "6a47694f5f39cb7aee21f10e",
    "IndividualId": "6a4765ff5f39cb7aee21f106",
    "Seq": 1,
    "Type": "SourceOfFunds",
    "Attachment": {
      "Urls": [
        {
          "Key": "/api/o/assets/j/eyJhbGci..."
        }
      ],
      "Time": 1783064911
    },
    "FlowStatus": 1,
    "Source": 0,
    "DocCategoryId": "6a4765ff5f39cb7aee21f107",
    "ErrorMessage": null,
    "CreatedAt": 1783064911,
    "UpdatedAt": 1783064911
  }
}

Query parameter names are lowercase (`applicationId`, `type`, `individualId`). Maximum file size: 10 MB. Supported formats: `application/pdf`, `image/png`, `image/jpeg`.

ℹ Note

A 423 Application Locked response is returned when the application is in a locked or final status. No further modifications are permitted until FV Bank unlocks the application.

ℹ Note

On 400 validation errors, each error in ResponseErrors includes a Field property that identifies the failing PascalCase request body field (e.g. Business.Phone, Email, Address.City). Use this to surface precise field-level error messages in your UI.

Requires `session-token: {SessionToken}` from Create GMA Session. Use the same client IP as authentication.