> ## Documentation Index > Fetch the complete documentation index at: https://docs.go.aiinsurance.io/llms.txt > Use this file to discover all available pages before exploring further. # Prepare File Migration > Step 1 of bulk-loading documents from another system into a company that is still in Sandbox mode. It registers one source file and returns a resumable upload URL. Upload the bytes to that URL, then call Finalize File Migration (`finalizeCompanyFileMigration`) and Reconcile File Migration Metadata (`reconcileCompanyFileMigration`). For an everyday upload, use Create Upload Intent (`createCompanyFileUploadIntent`) instead. Creates or retrieves a logical file and upload revision by the durable source identity, scoped to the destination company. Repeated and concurrent calls return the same active file/version. Distinct source file IDs remain separate even when bytes match. A newer source generation with unchanged verified bytes reuses the current imported version; changed bytes create a version of the same file. A newer generation supersedes an unfinished revision and fences stale requests. Reclaimed pending versions recover beneath the same logical file. This call creates no placement. Persist the returned IDs before transferring bytes to the resumable upload URL. Available only while the destination company is in Sandbox mode. Forms are outside this contract. **Required permission:** `file.upload` Also requires `file.view` and `file.edit`. ## OpenAPI ````yaml /openapi/generated-external-api.yaml post /api/v1/companies/{companyId}/files/migrations/prepare openapi: 3.0.3 info: title: AI Insurance External API description: External API for AI Insurance platform version: 1.0.0 contact: email: support@aiinsurance.io servers: - url: https://go.aiinsurance.io description: Production security: - ApiKeyAuth: [] paths: /api/v1/companies/{companyId}/files/migrations/prepare: post: tags: - Company Files summary: Prepare File Migration description: > Step 1 of bulk-loading documents from another system into a company that is still in Sandbox mode. It registers one source file and returns a resumable upload URL. Upload the bytes to that URL, then call Finalize File Migration (`finalizeCompanyFileMigration`) and Reconcile File Migration Metadata (`reconcileCompanyFileMigration`). For an everyday upload, use Create Upload Intent (`createCompanyFileUploadIntent`) instead. Creates or retrieves a logical file and upload revision by the durable source identity, scoped to the destination company. Repeated and concurrent calls return the same active file/version. Distinct source file IDs remain separate even when bytes match. A newer source generation with unchanged verified bytes reuses the current imported version; changed bytes create a version of the same file. A newer generation supersedes an unfinished revision and fences stale requests. Reclaimed pending versions recover beneath the same logical file. This call creates no placement. Persist the returned IDs before transferring bytes to the resumable upload URL. Available only while the destination company is in Sandbox mode. Forms are outside this contract. **Required permission:** `file.upload` Also requires `file.view` and `file.edit`. operationId: prepareCompanyFileMigration parameters: - $ref: '#/components/parameters/companyId' requestBody: required: true content: application/json: schema: type: object additionalProperties: false required: - source - revision - metadata properties: source: $ref: '#/components/schemas/CompanyFileMigrationSource' revision: $ref: '#/components/schemas/CompanyFileMigrationRevision' metadata: $ref: '#/components/schemas/CompanyFileMigrationMetadata' examples: request: summary: Prepare File Migration value: source: environment: https://legacy.example.com companyId: legacy-company-42 fileId: legacy-file-17 revision: bucket: legacy-company-files object: documents/loss-run.pdf generation: '1720000000000000' byteSize: 102400 contentType: application/pdf md5Hash: 1B2M2Y8AsgTpgAmY7PhCfg== metadata: displayName: Loss run.pdf displayDate: '2020-01-02T03:04:05.000Z' displayAuthor: Legacy adjuster originalFilename: loss-run.pdf responses: '200': description: Durable migration state headers: Cache-Control: schema: type: string description: Always no-store because state can include upload capabilities. content: application/json: schema: $ref: '#/components/schemas/CompanyFileMigrationState' examples: success: summary: Prepare File Migration value: sourceId: 550e8400-e29b-41d4-a716-446655440019 fileId: 550e8400-e29b-41d4-a716-446655440020 currentVersionId: null revision: versionId: 550e8400-e29b-41d4-a716-446655440021 storageKey: >- companies/example/files/550e8400-e29b-41d4-a716-446655440020/550e8400-e29b-41d4-a716-446655440021 state: pending uploadUrl: >- https://storage.googleapis.com/upload/storage/v1/b/files/o?uploadType=resumable&upload_id=REDACTED byteSize: 102400 contentType: application/pdf metadata: displayName: Loss run.pdf displayDate: '2020-01-02T03:04:05.000Z' displayAuthor: Legacy adjuster conflicts: [] '400': description: Invalid migration declaration content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: failure: summary: Invalid migration declaration value: error: code: BadRequest message: Invalid migration declaration '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '409': description: Migration requires reconciliation content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: failure: summary: Migration requires reconciliation value: error: code: FileMigrationConflict message: destination_version_changed '500': $ref: '#/components/responses/InternalServerError' security: - BearerAuth: [] - ApiKeyAuth: [] components: parameters: companyId: name: companyId in: path required: true schema: type: string format: uuid description: Company identifier schemas: CompanyFileMigrationSource: type: object additionalProperties: false required: - environment - companyId - fileId properties: environment: type: string minLength: 1 maxLength: 512 description: >- Stable legacy environment identity, at most 512 UTF-8 bytes. Keep it unchanged across runs and credential rotations. companyId: type: string minLength: 1 maxLength: 255 description: Stable source identifier, at most 255 UTF-8 bytes. fileId: type: string minLength: 1 maxLength: 255 description: Stable source identifier, at most 255 UTF-8 bytes. CompanyFileMigrationRevision: description: >- Exact source object declaration. At least one base64 checksum from source object metadata is required. Every available common checksum must match destination storage before finalization. allOf: - type: object additionalProperties: false required: - bucket - object - generation - byteSize - contentType properties: bucket: type: string minLength: 1 maxLength: 255 object: type: string minLength: 1 maxLength: 2048 generation: type: string pattern: ^\d+$ maxLength: 40 description: >- Exact GCS source generation; pin every source read to this generation. byteSize: type: integer minimum: 1 maximum: 2147483648 contentType: type: string minLength: 1 maxLength: 255 description: Supported MIME type; normalized to lowercase. md5Hash: type: string pattern: ^[A-Za-z0-9+/]{22}==$ crc32c: type: string pattern: ^[A-Za-z0-9+/]{6}==$ - anyOf: - type: object required: - md5Hash properties: md5Hash: type: string pattern: ^[A-Za-z0-9+/]{22}==$ - type: object required: - crc32c properties: crc32c: type: string pattern: ^[A-Za-z0-9+/]{6}==$ CompanyFileMigrationMetadata: type: object additionalProperties: false required: - displayName - displayDate - displayAuthor - originalFilename properties: displayName: type: string minLength: 1 maxLength: 1024 description: Source display name; independent of the storage upload filename. displayDate: type: string format: date-time nullable: true description: >- Source attribution date. Stored at whole-second precision; null clears it. displayAuthor: type: string minLength: 1 maxLength: 255 nullable: true description: >- Source attribution label, trimmed. Audit actors remain the authenticated importer. originalFilename: type: string minLength: 1 maxLength: 1024 description: >- Validated upload filename for a newly created version. Does not replace the display name. CompanyFileMigrationState: type: object additionalProperties: false required: - sourceId - fileId - currentVersionId - revision - metadata - conflicts properties: sourceId: type: string format: uuid fileId: type: string format: uuid currentVersionId: type: string format: uuid nullable: true revision: type: object additionalProperties: false required: - versionId - storageKey - state - uploadUrl - byteSize - contentType properties: versionId: type: string format: uuid storageKey: type: string state: type: string enum: - pending - ready - quarantined - infected uploadUrl: type: string nullable: true description: >- Bearer resumable-upload capability. Present only for an active pending revision without conflicts; never log or expose it in diagnostics. byteSize: type: integer minimum: 1 maximum: 2147483648 contentType: type: string nullable: true description: >- Requested revision, or the active revision when none is supplied; null if absent or its version was reclaimed. metadata: $ref: '#/components/schemas/CompanyFileMigrationDisplayMetadata' conflicts: type: array items: type: string description: >- Stable diagnostic codes, including deleted targets, operator version changes, superseded source revisions, reclaimed versions and infected results. ErrorResponse: type: object description: Standard error response for all external API endpoints required: - error properties: error: type: object required: - code - message properties: code: type: string description: Machine-readable error code example: VALIDATION_ERROR message: type: string description: Human-readable error message example: 'submissionId: Required field is missing' userMessages: type: array description: >- Clean, verbatim-displayable messages — one entry per failure, free of error-code tags, field paths, and internal noise. Suitable for showing to end users as-is. items: type: string example: - Exposures of type 'company' require an address details: type: array description: Additional details for validation errors (field-level errors) items: type: object properties: field: type: string description: The field that caused the error example: submissionId code: type: string description: Stable problem code for this individual validation failure example: BLANK_LIST_ELEMENT reason: type: string description: Stable reason the value violates its canonical contract example: blank-list-element expected: type: string description: The expected canonical value contract example: nonblank trimmed string message: type: string description: Description of the field error example: Required field is missing CompanyFileMigrationDisplayMetadata: type: object additionalProperties: false required: - displayName - displayDate - displayAuthor properties: displayName: type: string minLength: 1 maxLength: 1024 description: Source display name; independent of the storage upload filename. displayDate: type: string format: date-time nullable: true description: >- Source attribution date. Stored at whole-second precision; null clears it. displayAuthor: type: string minLength: 1 maxLength: 255 nullable: true description: >- Source attribution label, trimmed. Audit actors remain the authenticated importer. responses: Unauthorized: description: Unauthorized - Invalid or missing API key content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingApiKey: summary: Missing API key value: error: code: AuthenticationError message: API key authentication required userMessages: - API key authentication required invalidApiKey: summary: >- Invalid API key (e.g. unknown key, or a Bearer token used instead of an API key) value: error: code: AuthenticationError message: Invalid API key userMessages: - Invalid API key Forbidden: description: Forbidden - Insufficient permissions content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: insufficientPermissions: summary: Insufficient permissions value: error: code: AuthorizationError message: User is not authorized to perform the requested action userMessages: - User is not authorized to perform the requested action companyMismatch: summary: A valid API key naming another company in the URL value: error: code: AuthorizationError message: API key is not scoped to the requested company userMessages: - API key is not scoped to the requested company InternalServerError: description: Internal Server Error - Unexpected error occurred content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internalError: summary: Unexpected server error value: error: code: UncaughtActionError message: Uncaught error occurred in userMessages: - An unexpected error occurred. Please try again later. securitySchemes: ApiKeyAuth: type: apiKey in: header name: Authorization description: >- API key authentication. Send your raw API key as the `Authorization` header value with NO scheme prefix — `Authorization: YOUR-API-KEY`. Do NOT prefix it with `Bearer ` or `ApiKey `, and do not use an `X-API-Key` header; those are not accepted. BearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- User-principal OAuth 2.0 Bearer authentication. Send a user-scoped Auth0 access token (audience = the app API audience) as `Authorization: Bearer `. The request resolves to the user's identity and is authorized by their Role on the `{companyId}` in the path — the same role-based permissions the web app enforces. This is the path the MCP connector uses to act on a user's behalf; endpoints that accept it list both `BearerAuth` and `ApiKeyAuth`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.