Upload a document to a project (REST multipart)

curl --request POST \
  --url https://app.auditynow.com/api/agent/projects/{id}/documents \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Length: <content-length>' \
  --header 'Content-Type: multipart/form-data' \
  --form file='@example-file' \
  --form category=audit \
  --form 'department=<string>'

import requests

url = "https://app.auditynow.com/api/agent/projects/{id}/documents"

files = { "file": ("example-file", open("example-file", "rb")) }
payload = {
    "category": "audit",
    "department": "<string>"
}
headers = {
    "Content-Length": "<content-length>",
    "Authorization": "Bearer <token>"
}

response = requests.post(url, data=payload, files=files, headers=headers)

print(response.text)

const form = new FormData();
form.append('file', '<string>');
form.append('category', 'audit');
form.append('department', '<string>');

const options = {
  method: 'POST',
  headers: {'Content-Length': '<content-length>', Authorization: 'Bearer <token>'}
};

options.body = form;

fetch('https://app.auditynow.com/api/agent/projects/{id}/documents', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.auditynow.com/api/agent/projects/{id}/documents",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\naudit\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"department\"\r\n\r\n<string>\r\n-----011000010111000001101001--",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Length: <content-length>",
    "Content-Type: multipart/form-data"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.auditynow.com/api/agent/projects/{id}/documents"

	payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\naudit\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"department\"\r\n\r\n<string>\r\n-----011000010111000001101001--")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Length", "<content-length>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://app.auditynow.com/api/agent/projects/{id}/documents")
  .header("Content-Length", "<content-length>")
  .header("Authorization", "Bearer <token>")
  .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\naudit\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"department\"\r\n\r\n<string>\r\n-----011000010111000001101001--")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.auditynow.com/api/agent/projects/{id}/documents")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Length"] = '<content-length>'
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\naudit\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"department\"\r\n\r\n<string>\r\n-----011000010111000001101001--"

response = http.request(request)
puts response.read_body

{
  "data": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "documentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "clientName": "<string>",
    "fileName": "<string>",
    "fileType": "<string>",
    "fileSize": 123,
    "sha256": "<string>",
    "storagePath": "<string>",
    "department": "<string>",
    "uploadStatus": "<string>",
    "createdAt": "2023-11-07T05:31:56Z"
  },
  "nextStep": "Call audity_enqueue_document_analysis (or POST .../audit-analysis/async) to analyze uploaded documents."
}

Documents

Upload a document to a project (REST multipart)

Uploads a document via REST multipart/form-data, no MCP connection required. Streams the file bytes in the request body; the route validates type, size, and magic bytes, stores the file in Supabase Storage, and registers a documents row, returning a durable documentId.

Does NOT trigger analysis. Call POST /api/agent/projects/{id}/audit-analysis/async (or the MCP audity_enqueue_document_analysis tool) once documents are uploaded.

Cost: 0 credits, this is a free write.

Feature gates: both the agent-api and agent-document-upload flags must be enabled for the caller, otherwise 403 FEATURE_NOT_AVAILABLE.

Requires: the write scope on PATs.

Size limits: 10MB per file, 25MB for .pptx presentations.

POST

api

agent

projects

{id}

documents

Upload a document to a project (REST multipart)

curl --request POST \
  --url https://app.auditynow.com/api/agent/projects/{id}/documents \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Length: <content-length>' \
  --header 'Content-Type: multipart/form-data' \
  --form file='@example-file' \
  --form category=audit \
  --form 'department=<string>'

import requests

url = "https://app.auditynow.com/api/agent/projects/{id}/documents"

files = { "file": ("example-file", open("example-file", "rb")) }
payload = {
    "category": "audit",
    "department": "<string>"
}
headers = {
    "Content-Length": "<content-length>",
    "Authorization": "Bearer <token>"
}

response = requests.post(url, data=payload, files=files, headers=headers)

print(response.text)

const form = new FormData();
form.append('file', '<string>');
form.append('category', 'audit');
form.append('department', '<string>');

const options = {
  method: 'POST',
  headers: {'Content-Length': '<content-length>', Authorization: 'Bearer <token>'}
};

options.body = form;

fetch('https://app.auditynow.com/api/agent/projects/{id}/documents', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.auditynow.com/api/agent/projects/{id}/documents",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\naudit\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"department\"\r\n\r\n<string>\r\n-----011000010111000001101001--",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Length: <content-length>",
    "Content-Type: multipart/form-data"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.auditynow.com/api/agent/projects/{id}/documents"

	payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\naudit\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"department\"\r\n\r\n<string>\r\n-----011000010111000001101001--")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Length", "<content-length>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://app.auditynow.com/api/agent/projects/{id}/documents")
  .header("Content-Length", "<content-length>")
  .header("Authorization", "Bearer <token>")
  .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\naudit\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"department\"\r\n\r\n<string>\r\n-----011000010111000001101001--")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.auditynow.com/api/agent/projects/{id}/documents")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Length"] = '<content-length>'
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\naudit\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"department\"\r\n\r\n<string>\r\n-----011000010111000001101001--"

response = http.request(request)
puts response.read_body

{
  "data": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "documentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "clientName": "<string>",
    "fileName": "<string>",
    "fileType": "<string>",
    "fileSize": 123,
    "sha256": "<string>",
    "storagePath": "<string>",
    "department": "<string>",
    "uploadStatus": "<string>",
    "createdAt": "2023-11-07T05:31:56Z"
  },
  "nextStep": "Call audity_enqueue_document_analysis (or POST .../audit-analysis/async) to analyze uploaded documents."
}

Authorizations

Authorization

string

header

required

A Personal Access Token issued from https://app.auditynow.com/dashboard/settings/api-tokens. Format: aky_<32 random chars>.

Headers

Content-Length

integer

required

Byte length of the multipart body. Validated before the body is parsed: missing or non-positive returns 411; a value over the absolute body cap (25MB + multipart overhead) returns 413.

Required range: x >= 1

Idempotency-Key

string

Optional client-supplied key for safe retries. A random UUID is generated server-side if omitted.

Path Parameters

string<uuid>

required

The project's UUID.

Body

multipart/form-data

multipart/form-data parts for POST /api/agent/projects/{id}/documents.

file

required

The file to upload. Allowed types: PDF, Word (.doc/.docx), plain text, Markdown, audio (.mp3/.wav/.m4a), images (.png/.jpg/.jpeg/.webp), spreadsheets (.csv/.xlsx/.xls), presentations (.pptx), XML, and email (.eml). Max 10MB per file, 25MB for .pptx.

Response

Document uploaded and registered.

data

object

required

The registered document record returned by the agent upload endpoint.

Show child attributes

nextStep

string

required

Guidance for what to call next.

Example:

"Call audity_enqueue_document_analysis (or POST .../audit-analysis/async) to analyze uploaded documents."

Partially update an assessment config Poll async job status