> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squadvault.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Request document upload URL

> Request a presigned upload URL for a new document file.
Requires `document:create` on the organization.
Documents are private: map `key` → `fileKey` and `fileRef` → `fileUrl` when creating the document.
The API overwrites `fileUrl` with an opaque storage reference; downloads use signed URLs.




## OpenAPI

````yaml /openapi.yaml post /uploads/document-file
openapi: 3.1.0
info:
  title: SquadVault Public API
  version: 1.0.0
  description: >
    Organization-scoped Public API for teams, players, documents, tryout
    applications, and uploads.

    Base path is `/v1`. Authenticate with an organization API key in the
    `x-api-key` header.


    The key is scoped to one organization. List and create calls still require
    that organization ID

    in the path, query, or body, and it must match the key. Tryout get, update,
    and convert-to-player

    always require `organizationId` (query on GET, JSON body on PATCH/POST). Get
    team/player by ID

    uses `/teams/{organizationId}/{teamId}` and
    `/players/{organizationId}/{playerId}`.

    Team, player, and document update/delete resolve the organization from the
    resource ID.
  contact:
    name: SquadVault Support
    email: hello@squadvault.xyz
    url: https://squadvault.xyz
servers:
  - url: https://api.squadvault.xyz/v1
    description: Production
security:
  - ApiKeyAuth: []
tags:
  - name: Teams
  - name: Players
  - name: Documents
  - name: Tryout Applications
  - name: Uploads
paths:
  /uploads/document-file:
    post:
      tags:
        - Uploads
      summary: Request document upload URL
      description: >
        Request a presigned upload URL for a new document file.

        Requires `document:create` on the organization.

        Documents are private: map `key` → `fileKey` and `fileRef` → `fileUrl`
        when creating the document.

        The API overwrites `fileUrl` with an opaque storage reference; downloads
        use signed URLs.
      operationId: requestDocumentUpload
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RequestDocumentUploadRequest'
            example:
              organizationId: org_example
              contentType: application/pdf
              sizeBytes: 102400
      responses:
        '200':
          description: Presigned upload details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DocumentUploadResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/ServerError'
components:
  schemas:
    RequestDocumentUploadRequest:
      type: object
      required:
        - organizationId
        - contentType
        - sizeBytes
      properties:
        organizationId:
          type: string
        contentType:
          $ref: '#/components/schemas/ContentType'
        sizeBytes:
          type: integer
          minimum: 1
          description: Exact file size in bytes (enforced on the presigned PUT)
    DocumentUploadResponse:
      type: object
      required:
        - key
        - fileRef
        - uploadUrl
      properties:
        key:
          type: string
          description: Use as `fileKey` when creating the document
        fileRef:
          type: string
          description: >-
            Opaque private storage reference to send as `fileUrl` (not a public
            HTTP URL)
        uploadUrl:
          type: string
          format: uri
          description: Presigned PUT URL for the file bytes
    ContentType:
      type: string
      enum:
        - application/pdf
        - application/msword
        - >-
          application/vnd.openxmlformats-officedocument.wordprocessingml.document
        - application/vnd.ms-excel
        - application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
        - text/plain
        - image/jpeg
        - image/png
        - image/webp
        - image/gif
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: string
          description: Machine-readable error code
  responses:
    BadRequest:
      description: Invalid request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: Missing or invalid credentials
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            unauthorized:
              value:
                error: unauthorized
            invalidApiKey:
              value:
                error: invalidApiKey
    Forbidden:
      description: Valid credentials but missing permission or feature
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            forbidden:
              value:
                error: forbidden
            featureNotAvailable:
              value:
                error: featureNotAvailable
    ServerError:
      description: Server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: Organization API key from Settings → API keys.

````