Skip to main content
Document uploads use three steps: request a presigned URL, upload the file to private storage, then create the document record. Document objects under documents/ are not publicly readable — preview and download always go through signed SquadVault URLs.

Flow

1. Request a presigned upload URL

Response:
Map fields when creating the document: fileKey ← key, fileUrl ← fileRef. The API overwrites fileUrl with a private storage reference. sizeBytes must match the exact byte length of the file you PUT in step 2.

2. Upload the file

Use the same Content-Type and byte size you requested in step 1.

3. Create the document record

To download or preview later, call GET /documents/{documentId}/download or /preview — never use fileUrl as a public HTTP link.

Allowed content types

  • application/pdf
  • application/msword
  • application/vnd.openxmlformats-officedocument.wordprocessingml.document
  • application/vnd.ms-excel
  • application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
  • text/plain
  • image/jpeg, image/png, image/webp, image/gif
Maximum file size depends on the organization plan (enforced server-side).

JavaScript example

Required permission for both upload URL and document create: document:create.