> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.crisscross.money/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.crisscross.money/_mcp/server. # Upload a supporting document PUT https://api.crisscross.money/v1/toc/orders/{orderId}/document-requirements/{docId} Content-Type: multipart/form-data Uploads or replaces a supporting document for a specific BOP requirement slot on an order. Idempotent — re-uploading replaces the previous file and resets the document status to `uploaded`. Max file size: 50 MB. Allowed MIME types: `image/png`, `image/jpeg`, `application/pdf`, `text/csv` (`.csv` files only). Reference: https://docs.crisscross.money/api-reference/toc-api/orders/upload-order-document-requirement ## Authentication - `Authorization` header (bearer token, required) — Token obtained via the login flow. ## Request ### Path parameters - `orderId` (string, required) - `docId` (string, required) ### Body (multipart/form-data) This endpoint expects a multipart form containing a file. - `file` (file, required) — The file to upload (PNG, JPEG, PDF, or CSV; max 50 MB). ## Response ### 200 Document uploaded successfully. - `id` (string, required) - `orderId` (string, required) - `label` (string, required) — Human-readable document label from the BOP document requirement. - `required` (boolean, required) — Whether this document is mandatory for this BOP category. - `status` (enum, required) — Current upload and review status of this document slot. - Allowed values: `not_uploaded`, `uploaded`, `approved`, `rejected` - `originalFilename` (string, optional, nullable) - `contentType` (string, optional, nullable) - `fileSizeBytes` (long, optional, nullable) - `uploadedAt` (datetime, optional, nullable) ## Errors ### 400 Bad Request Error Bad request — validation or malformed request. - `error` (ErrorEnvelopeError, required) ### 401 Unauthorized Error Unauthorized — missing or invalid token. - `error` (ErrorEnvelopeError, required) ### 403 Forbidden Error Forbidden — authenticated but not authorised for this resource. - `error` (ErrorEnvelopeError, required) ### 404 Not Found Error Resource not found. - `error` (ErrorEnvelopeError, required) ### 409 Conflict Error State conflict — resource is in a non-actionable state. - `error` (ErrorEnvelopeError, required) ## Types ### ErrorEnvelopeError - `code` (string, required) — Stable machine-readable identifier. Branch on this, not `message`. Common values: `INVALID_REQUEST`, `UNAUTHENTICATED`, `FORBIDDEN`, `RATE_NOT_AVAILABLE`, `RATE_NOT_FOUND`, `CURRENCY_NOT_SUPPORTED`, `CURRENCY_NOT_PROVISIONED`, `QUOTE_NOT_FOUND`, `QUOTE_EXPIRED`, `QUOTE_NOT_EXECUTABLE`, `ORDER_NOT_FOUND`, `DEPOSIT_NOT_FOUND`, `BENEFICIARY_NOT_FOUND`, `BENEFICIARY_NOT_ACTIVE`, `CURRENCY_MISMATCH`, `INSUFFICIENT_BALANCE`, `AMOUNT_OUT_OF_RANGE`, `WITHDRAWAL_NOT_FOUND`, `WITHDRAWAL_NOT_CANCELLABLE`, `IDEMPOTENCY_CONFLICT`, `INVALID_CURSOR`. - `message` (string, required) — Human-readable description. Do not parse. - `details` (map from string to any, optional) — Structured context about the error. Shape varies per code. ## Examples **Request** ```json { "file": "" } ``` **Response** ```json { "id": "doc_c1d2e3f4-e5f6-7890-abcd-ef1234567890", "orderId": "ord_550e8400-e29b-41d4-a716-446655440000", "label": "Pro Forma Invoice", "required": true, "status": "uploaded", "originalFilename": "invoice-2026-001.pdf", "contentType": "application/pdf", "fileSizeBytes": 245780, "uploadedAt": "2026-05-22T09:00:00Z" } ``` **SDK Code** ```python Orders_uploadOrderDocumentRequirement_example import requests url = "https://api.crisscross.money/v1/toc/orders/ord_550e8400-e29b-41d4-a716-446655440000/document-requirements/doc_550e8400-e29b-41d4-a716-446655440000" files = { "file": "open('string', 'rb')" } headers = {"Authorization": "Bearer "} response = requests.put(url, files=files, headers=headers) print(response.json()) ``` ```javascript Orders_uploadOrderDocumentRequirement_example const url = 'https://api.crisscross.money/v1/toc/orders/ord_550e8400-e29b-41d4-a716-446655440000/document-requirements/doc_550e8400-e29b-41d4-a716-446655440000'; const form = new FormData(); form.append('file', 'string'); const options = {method: 'PUT', headers: {Authorization: 'Bearer '}}; options.body = form; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go Orders_uploadOrderDocumentRequirement_example package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://api.crisscross.money/v1/toc/orders/ord_550e8400-e29b-41d4-a716-446655440000/document-requirements/doc_550e8400-e29b-41d4-a716-446655440000" payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"string\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001--\r\n") req, _ := http.NewRequest("PUT", url, payload) req.Header.Add("Authorization", "Bearer ") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby Orders_uploadOrderDocumentRequirement_example require 'uri' require 'net/http' url = URI("https://api.crisscross.money/v1/toc/orders/ord_550e8400-e29b-41d4-a716-446655440000/document-requirements/doc_550e8400-e29b-41d4-a716-446655440000") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Put.new(url) request["Authorization"] = 'Bearer ' request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"string\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001--\r\n" response = http.request(request) puts response.read_body ``` ```java Orders_uploadOrderDocumentRequirement_example import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.put("https://api.crisscross.money/v1/toc/orders/ord_550e8400-e29b-41d4-a716-446655440000/document-requirements/doc_550e8400-e29b-41d4-a716-446655440000") .header("Authorization", "Bearer ") .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"string\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001--\r\n") .asString(); ``` ```php Orders_uploadOrderDocumentRequirement_example request('PUT', 'https://api.crisscross.money/v1/toc/orders/ord_550e8400-e29b-41d4-a716-446655440000/document-requirements/doc_550e8400-e29b-41d4-a716-446655440000', [ 'multipart' => [ [ 'name' => 'file', 'filename' => 'string', 'contents' => null ] ] 'headers' => [ 'Authorization' => 'Bearer ', ], ]); echo $response->getBody(); ``` ```csharp Orders_uploadOrderDocumentRequirement_example using RestSharp; var client = new RestClient("https://api.crisscross.money/v1/toc/orders/ord_550e8400-e29b-41d4-a716-446655440000/document-requirements/doc_550e8400-e29b-41d4-a716-446655440000"); var request = new RestRequest(Method.PUT); request.AddHeader("Authorization", "Bearer "); request.AddParameter("undefined", "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"string\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001--\r\n", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift Orders_uploadOrderDocumentRequirement_example import Foundation let headers = ["Authorization": "Bearer "] let parameters = [ [ "name": "file", "fileName": "string" ] ] let boundary = "---011000010111000001101001" var body = "" var error: NSError? = nil for param in parameters { let paramName = param["name"]! body += "--\(boundary)\r\n" body += "Content-Disposition:form-data; name=\"\(paramName)\"" if let filename = param["fileName"] { let contentType = param["content-type"]! let fileContent = String(contentsOfFile: filename, encoding: String.Encoding.utf8) if (error != nil) { print(error as Any) } body += "; filename=\"\(filename)\"\r\n" body += "Content-Type: \(contentType)\r\n\r\n" body += fileContent } else if let paramValue = param["value"] { body += "\r\n\r\n\(paramValue)" } } let request = NSMutableURLRequest(url: NSURL(string: "https://api.crisscross.money/v1/toc/orders/ord_550e8400-e29b-41d4-a716-446655440000/document-requirements/doc_550e8400-e29b-41d4-a716-446655440000")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "PUT" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```