## Documentation Index

Fetch the complete documentation index at: [/llms.txt](https://docs.afriex.com/llms.txt)

Use this file to discover all available pages before exploring further.

### cURL

**upload-user**

```bash
curl --request POST \
  --url https://sandbox.api.afriex.com/api/v1/media/url \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "fileName": "passport.png",
  "type": "user"
}
'
```

### Response Codes

- **200**
- **400**
- **401**

```json
{
  "data": {
    "url": "https://s3.amazonaws.com/bucket/key?X-Amz-Algorithm=AWS4-HMAC-SHA256&..."
  }
}
```

```json
{
  "code": "<string>",
  "error": "<string>",
  "details": {
    "errorMessage": "<string>",
    "friendlyMessage": "<string>",
    "data": {
      "customerId": "<string>"
    }
  }
}
```

### API Endpoint

`POST https://sandbox.api.afriex.com/api/v1/media/url`

Generates a short-lived, presigned S3 URL that you can `PUT` a file to directly. Use it for KYC documents on customers or for transaction-related files such as SWIFT invoices.

### Steps to Use

1. **Request a URL**  
   Call `POST /api/v1/media/url` with the target `fileName` and a `type` (`user` for identity documents, `transaction` for transaction files). The response contains a presigned `url` and a stable `key`.

2. **Upload the file**  
   Send an HTTP `PUT` to the `url` with the file bytes as the body. Complete the upload before the URL expires.

3. **Reference the file**  
   Attach the returned `key` to any follow-up request (for example, the `invoice` field on a SWIFT withdraw, or a document field in [SME Registration](https://docs.afriex.com/api-reference/endpoint/sme-registration/register)). The presigned `url` itself expires shortly after issuance and is not accepted downstream.

### Authorizations

**x-api-key**  
string  
header  
required  
Static business API key issued from the dashboard. A business can provision multiple API keys, each scoped to a configurable set of permissions (e.g., read transactions, create deposits, etc). Permissions are chosen per key at creation time in the dashboard and may be revoked by deleting the key. Requests made with a key that does not include the permission required by the target endpoint will be rejected with a `403 Forbidden` response; an unrecognized, malformed, or revoked key returns `401 Unauthorized`. Manage your keys and their permissions under Developer → API keys in the dashboard.

### Headers

**x-api-version**  
string  
API version in ISO 8601 format (e.g., 2025-12-28). Defaults to latest stable.

### Body

**application/json**

**fileName**  
string  
required  
The name of the file to upload.  
**Example:**  
`"document.pdf"`

**type**  
enum<string>  
The category of the file being uploaded. Use `transaction` for transaction-related files (e.g., a transactions CSV) and `user` for user identity documents. Defaults to `user` when omitted.  
**Available options:**  
`transaction`,  
`user`

### Response

**200**  
application/json  
Presigned URL generated successfully.