> ## Documentation Index > Fetch the complete documentation index at: https://docs.kirafin.ai/llms.txt > Use this file to discover all available pages before exploring further. # Upload files to a document item > Answer a `document` item by uploading its files as `multipart/form-data`. One call can carry several, because one thing asked for may be several files. **Uploading adds to the set; it never replaces it.** A second upload leaves the first file in place. ## OpenAPI ````yaml /openapi/kira-api.2026-06-01.json post /v1/rfis/{rfi_id}/items/{item_id}/documents openapi: 3.1.0 info: title: Kira API version: '2026-06-01' description: >- REST API for users, KYC/KYB verification, virtual accounts, payouts, recipients, and webhooks. Every request requires an `x-api-key` header and a bearer access token (see Authentication). Pin your account to version `2026-04-14` before integrating. contact: name: Kira API Support email: support@kirafin.ai servers: - url: https://api.balampay.com description: Production - url: https://api.balampay.com/sandbox description: Sandbox security: - bearerAuth: [] apiKeyAuth: [] tags: - name: Authentication - name: Versioning - name: Users - name: Virtual Accounts - name: Recipients - name: Quotations - name: Payouts - name: Reference - name: RFIs paths: /v1/rfis/{rfi_id}/items/{item_id}/documents: post: tags: - RFIs summary: Upload files to a document item description: >- Answer a `document` item by uploading its files as `multipart/form-data`. One call can carry several, because one thing asked for may be several files. **Uploading adds to the set; it never replaces it.** A second upload leaves the first file in place. operationId: post_v1-rfis-rfi-id-items-item-id-documents parameters: - in: path name: rfi_id required: true schema: type: string format: uuid description: RFI UUID. - in: path name: item_id required: true schema: type: string format: uuid description: Item UUID. The item must be a `document` item of this RFI. - in: header name: X-Api-Version required: false description: >- Version applied to this request. It wins over your account's pinned version — see [Versioning](/using-the-api/versioning). schema: type: string example: '2026-06-01' requestBody: required: true content: multipart/form-data: schema: type: object required: - files properties: files: type: array items: type: string format: binary description: One or more files. Repeat the field per file. responses: '201': description: The files were stored. content: application/json: schema: $ref: '#/components/schemas/RfiItemDocumentsResponse' example: item: item_id: 1a2b3c4d-5e6f-4708-9a1b-2c3d4e5f6a7b ordinal: 1 prompt: >- Upload the certificate of good standing issued in the last 90 days. answer_type: document answer_spec: max_files: 3 target_key: null subject: null status: answered answer_value: null documents: - document_id: 9f8e7d6c-5b4a-4321-8765-4321fedcba98 file_name: certificate-of-good-standing.pdf mime_type: application/pdf size_bytes: 184320 checksum: >- 9f2b1c4e8a6d3f705b1e9c8d7a6f5e4d3c2b1a0908f7e6d5c4b3a2918070605 uploaded_at: '2026-09-02T09:15:00.000Z' review_note: null updated_at: '2026-09-02T09:15:00.000Z' returned_at: null '400': description: Malformed `rfi_id`, `item_id`, or `document_id`. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' example: code: validation_error message: Invalid request body '401': description: Unauthorized. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: invalid_request message: >- The request could not be authenticated. Check the x-api-key and Authorization headers. '404': description: >- The RFI belongs to another client or is `withdrawn`, the item does not belong to this RFI, or the RFI has no such file. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: not_found message: RFI not found '409': description: >- The RFI is already closed (`resolved` or `not_resolved`) — the answer was already reviewed and may already have been written to the subclient's profile. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: conflict message: This RFI is closed and no longer accepts answers '422': description: >- A file outside the item's accepted `mime_types`, a set that would pass `max_files`, a file over 30 MB or more than 20 files in one call, a file whose bytes are not the type it was sent as, an item that asked for something other than files, or an empty multipart body. Nothing is stored. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: unprocessable message: The answer does not satisfy the item's answer_spec security: - bearerAuth: [] apiKeyAuth: [] servers: - url: https://api.balampay.com/sandbox description: Sandbox - url: https://api.balampay.com description: Production components: schemas: RfiItemDocumentsResponse: type: object properties: item: $ref: '#/components/schemas/RfiItem' ValidationErrorResponse: type: object description: >- Validation / request error. The body shape is **not uniform** across the API — it varies by endpoint and by which validation layer rejects the request. The fields below are the union of what may appear; treat them all as optional. Observed shapes include `{ code, message }`, `{ code, message, errors[] }`, `{ code, error, details[] }`, `{ error, details[] }`, and a nested `{ error: { code, message, details } }`. Always branch on the HTTP status, not on a fixed body shape. properties: code: type: string message: type: string error: type: - string - object description: >- A short error label (e.g. `"Invalid data"`), or on some endpoints a nested `{ code, message, details }` object. errors: type: array items: type: object properties: field: type: string message: type: string required: - field - message details: type: - array - object description: >- Per-issue detail. Shape varies by endpoint — typically an array of `{ message }` or `{ path, message, code }`, occasionally an object. ErrorResponse: type: object properties: message: type: string code: type: string statusCode: type: number error: type: string timestamp: type: string path: type: string details: {} required: - message RfiItem: type: object description: >- One thing being asked for. The addressable unit of an RFI — a `PATCH` or a document upload always names an `item_id`, never the parent RFI. properties: item_id: type: string format: uuid ordinal: type: integer description: Display order within the RFI. prompt: type: string description: What is being asked, in prose. answer_type: type: string enum: - text_long - text_short - number - date - boolean - choice - identifier - document - ubo_link description: >- What the item is asking for, and therefore what a valid answer looks like. See [RFI values](/reference/rfis/values#answer_type). answer_spec: type: object additionalProperties: true description: >- The complete set of rules this item validates an answer against, not a suggestion. Which keys it holds is fixed by `answer_type` — see [RFI values](/reference/rfis/values#answer_spec-by-answer-type). example: options: - ssn - itin target_key: type: - string - 'null' description: >- The named subclient field this answer writes on acceptance (e.g. `ein`), or `null` when the answer lives only on this item. subject: type: - object - 'null' description: >- Who the item is about. `null` for the sub-client itself; otherwise the associated person it names. properties: person_id: type: string description: >- The `person_id` of the entry in the subclient's `associated_persons`. display_name: type: - string - 'null' description: >- The person's name as currently stored — first, middle and last — or `null` when they can no longer be found. example: person_id: 3f1c2a9b7e0d4c6a8b5f1e2d3c4b5a69 display_name: María López required: - person_id - display_name status: type: string enum: - pending - answered description: >- Whether this item is answered. An item has no ending of its own — whether the request is satisfied is the request's own `status`. See [RFI values](/reference/rfis/values#item-status). answer_value: type: - string - number - boolean - 'null' description: >- The answer recorded, in the shape `answer_type` expects. `null` on a `document` item, whose answer lives in `documents`. documents: type: array items: $ref: '#/components/schemas/RfiDocument' description: Always present; empty unless `answer_type` is `document`. review_note: type: - string - 'null' description: >- Why the item was sent back for another answer. Cleared the next time it is answered. updated_at: type: - string - 'null' format: date-time description: >- When this item was last answered. Moves on every round, whether or not it changes the item's status. returned_at: type: - string - 'null' format: date-time description: >- When the item was last sent back for another answer. `null` if it never has been, including while it is under review. RfiDocument: type: object properties: document_id: type: string format: uuid file_name: type: string description: >- The name the file was uploaded under, sanitized. This is the name it downloads as — the internal storage path is never exposed. example: january.pdf mime_type: type: string example: application/pdf size_bytes: type: integer checksum: type: string description: Content hash of the uploaded file. uploaded_at: type: string format: date-time securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- The `data.access_token` value from [Get access token](/api-reference/authentication/get-access-token). apiKeyAuth: type: apiKey in: header name: x-api-key description: API key issued by Kira. ````