> ## Documentation Index > Fetch the complete documentation index at: https://docs.go.aiinsurance.io/llms.txt > Use this file to discover all available pages before exploring further. # Create Upload Intent > Phase 1 of the two-phase upload: declare the file (owner, name, MIME type, exact byte size) and receive a short-lived signed `uploadUrl` pinned to the declared content type and byte size. To complete the upload: 1. `PUT` the raw bytes to `uploadUrl` with TWO headers, both signed into the URL (the storage host rejects the request without them): `Content-Type: ` and `x-goog-content-length-range: ,`. Bytes go straight to cloud storage — never through this API. 2. `POST /files/{fileId}/finalize` with the returned `versionId` to make the file visible. Until finalize the file's `status` is `pending` and it appears in no listing. The signed URL expires after 15 minutes; abandoned pending uploads are reclaimed automatically. Files belong to an owner: a configured entity (`entityType` + `entityId`) or the whole company (`entityType: "company"`, no `entityId`). Optionally place the file inside one of the owner's folders with `folderId`. **Required permission:** `company.file:create` ## OpenAPI ````yaml /openapi/generated-external-api.yaml post /api/v1/companies/{companyId}/files openapi: 3.0.3 info: title: AI Insurance External API description: External API for AI Insurance platform version: 1.0.0 contact: email: support@aiinsurance.io servers: - url: https://go.aiinsurance.io description: Production security: - ApiKeyAuth: [] paths: /api/v1/companies/{companyId}/files: post: tags: - Company Files summary: Create Upload Intent description: | Phase 1 of the two-phase upload: declare the file (owner, name, MIME type, exact byte size) and receive a short-lived signed `uploadUrl` pinned to the declared content type and byte size. To complete the upload: 1. `PUT` the raw bytes to `uploadUrl` with TWO headers, both signed into the URL (the storage host rejects the request without them): `Content-Type: ` and `x-goog-content-length-range: ,`. Bytes go straight to cloud storage — never through this API. 2. `POST /files/{fileId}/finalize` with the returned `versionId` to make the file visible. Until finalize the file's `status` is `pending` and it appears in no listing. The signed URL expires after 15 minutes; abandoned pending uploads are reclaimed automatically. Files belong to an owner: a configured entity (`entityType` + `entityId`) or the whole company (`entityType: "company"`, no `entityId`). Optionally place the file inside one of the owner's folders with `folderId`. **Required permission:** `company.file:create` operationId: createCompanyFileUploadIntent parameters: - $ref: '#/components/parameters/companyId' requestBody: required: true content: application/json: schema: type: object required: - entityType - fileName - contentType - byteSize properties: entityType: type: string enum: - event - exposure - quote - submission - person - organization - policy - company description: The file owner's entity type entityId: type: string format: uuid nullable: true description: > The owner entity's id. Required for every `entityType` except `company` (omit or send null for company-level files). folderId: type: string format: uuid nullable: true description: >- Folder to place the file in (omit or null for the owner's top level) fileName: type: string description: File name (must be non-empty) contentType: type: string description: >- MIME type of the file (e.g. `application/pdf`); must be an allowed type byteSize: type: integer description: Exact size of the upload in bytes (max 104857600 = 100 MiB) displayDate: type: string format: date-time description: >- Optional back-datable "as of" ISO 8601 timestamp. When set, file listings display and sort the file by this date instead of its upload time — intended for historical imports and integrations. The audit timestamps and uploader attribution stay server-set. displayAuthor: type: string maxLength: 255 description: >- Optional user-visible uploader label (trimmed; must be non-empty). When set, the file is presented as uploaded by this label instead of the uploader's name — intended for historical imports carrying the source system's author (or a marker like "Data Import"). Uploader attribution stays server-set. examples: companyLevelFile: summary: Company-level file value: entityType: company fileName: master-agreement.pdf contentType: application/pdf byteSize: 482133 entityFileInFolder: summary: Exposure-owned file placed in a folder value: entityType: exposure entityId: 550e8400-e29b-41d4-a716-446655440010 folderId: 550e8400-e29b-41d4-a716-446655440001 fileName: loss-run.pdf contentType: application/pdf byteSize: 102400 responses: '201': description: Upload intent created — PUT the bytes to `uploadUrl`, then finalize content: application/json: schema: type: object properties: fileId: type: string format: uuid description: Id of the created file (still `pending`) versionId: type: string format: uuid description: Id of the pending version — pass it to finalize uploadUrl: type: string description: >- Short-lived signed URL to PUT the file bytes to (expires in 15 minutes) examples: success: summary: Upload intent value: fileId: 550e8400-e29b-41d4-a716-446655440020 versionId: 550e8400-e29b-41d4-a716-446655440021 uploadUrl: >- https://storage.googleapis.com/bucket/companies/.../files/...?X-Goog-Expires=900&X-Goog-Signature=... '400': description: Bad Request — Validation error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: contentTypeNotAllowed: summary: Disallowed MIME type value: error: code: BadRequest message: 'Content type not allowed: application/x-msdownload' fileTooLarge: summary: Declared size over the cap value: error: code: BadRequest message: File exceeds the maximum upload size of 104857600 bytes missingEntityId: summary: Entity owner without entityId value: error: code: BadRequest message: Missing entityId '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': description: Owner entity or target folder not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: ownerNotFound: summary: Owner entity does not exist value: error: code: NotFound message: >- Owner entity not found: 550e8400-e29b-41d4-a716-446655440010 folderNotFound: summary: Target folder does not exist value: error: code: NotFound message: 'Folder not found: 550e8400-e29b-41d4-a716-446655440001' '500': $ref: '#/components/responses/InternalServerError' components: parameters: companyId: name: companyId in: path required: true schema: type: string format: uuid description: Company identifier schemas: ErrorResponse: type: object description: Standard error response for all external API endpoints required: - error properties: error: type: object required: - code - message properties: code: type: string description: Machine-readable error code example: VALIDATION_ERROR message: type: string description: Human-readable error message example: 'submissionId: Required field is missing' userMessages: type: array description: >- Clean, verbatim-displayable messages — one entry per failure, free of error-code tags, field paths, and internal noise. Suitable for showing to end users as-is. items: type: string example: - Exposures of type 'company' require an address details: type: array description: Additional details for validation errors (field-level errors) items: type: object properties: field: type: string description: The field that caused the error example: submissionId message: type: string description: Description of the field error example: Required field is missing responses: Unauthorized: description: Unauthorized - Invalid or missing API key content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingApiKey: summary: Missing API key value: error: code: AuthenticationError message: API key authentication required userMessages: - API key authentication required invalidApiKey: summary: >- Invalid API key (e.g. unknown key, or a Bearer token used instead of an API key) value: error: code: AuthenticationError message: Invalid API key userMessages: - Invalid API key Forbidden: description: Forbidden - Insufficient permissions content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: insufficientPermissions: summary: Insufficient permissions value: error: code: AuthorizationError message: User is not authorized to perform the requested action userMessages: - User is not authorized to perform the requested action companyMismatch: summary: A valid API key naming another company in the URL value: error: code: AuthorizationError message: API key is not scoped to the requested company userMessages: - API key is not scoped to the requested company InternalServerError: description: Internal Server Error - Unexpected error occurred content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internalError: summary: Unexpected server error value: error: code: UncaughtActionError message: Uncaught error occurred in userMessages: - An unexpected error occurred. Please try again later. securitySchemes: ApiKeyAuth: type: apiKey in: header name: Authorization description: >- API key authentication. Send your raw API key as the `Authorization` header value with NO scheme prefix — `Authorization: YOUR-API-KEY`. Do NOT prefix it with `Bearer ` or `ApiKey `, and do not use an `X-API-Key` header; those are not accepted. ````