# Upload Document

`POST /people/documents`

Group: People Management › Documents · Operation ID: `uploadDocument`

Creates an employee document from a base64-encoded file. The stored file name and the initial status are set by the system, not by you: the status is 'approved' when an HR administrator files a document for another employee, and 'pending' otherwise. The response is only the new document's id, so read the stored name and status from GET people/documents.

[Open in the interactive reference](https://docs.api.lensing.ai/?op=uploadDocument)

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `Api-Version` | header | `"v1"` | yes | The API version this request targets, named by its public identifier. Required on every request; omitting it, or naming a version this company does not have, is answered with 400. This document describes version `v1`. |
| `Idempotency-Key` | header | string | no | An opaque caller-chosen string (1-255 characters) that makes this request safe to retry. Repeating the same key with an identical request body replays the original response instead of re-executing - but only once that original request succeeded; a failed attempt re-executes on retry. Repeating the key with a different body is answered with 422. A key still in flight is answered with 409 - as is a key whose original request was interrupted before it finished, for a few minutes afterwards, until that attempt is presumed dead. A completed response stays replayable for 24 hours. The key is scoped to the caller, not to the action: reusing it for a different action is answered with 409 or 422 rather than treated independently. On read actions this header is ignored. On write actions that cannot offer the guarantee it is answered with `400 IDEMPOTENCY_NOT_SUPPORTED` rather than silently ignored. |

## Request body

Required, `application/json`: uploadDocumentInput.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `employeeId` | string | yes | The identifier of the employee the document belongs to. See id on GET people/:id. |
| `categoryId` | string | yes | The identifier of the document category to file the document under. See id on GET people/document-categories. |
| `fileName` | string | yes | The name of the file being uploaded, with its extension. Only the extension is kept, and the stored file name is generated from the category label and the employee's name. |
| `mimeType` | string | yes | The MIME type of the file, for example 'application/pdf'. |
| `contentBase64` | string | yes | The file's bytes, base64-encoded with the standard alphabet and padding. Must be non-empty and well-formed. |
| `expiryDate` | string | no | The day the document expires. Use format YYYY-MM-DD. Omit for a document that does not expire. |

Example:

```json
{
  "employeeId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "categoryId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "fileName": "<fileName>",
  "mimeType": "<mimeType>",
  "contentBase64": "<contentBase64>",
  "expiryDate": "<expiryDate>"
}
```

## Response

`200` Success

Under `data` (uploadDocumentOutput):

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | yes | The unique identifier for the created document. |

## Response headers

- `Idempotency-Replayed` — Present and `true` only when this response replays a previously stored one for the same Idempotency-Key, rather than reflecting a live execution. Absent on a live response - never sent as `false`.

## Errors

| Code | Status |
| --- | --- |
| `EMPLOYEE_NOT_FOUND` | 400 |
| `CATEGORY_NOT_FOUND` | 400 |
| `INVALID_FILE_CONTENT` | 400 |
| `INVALID_EXPIRY_DATE` | 400 |
| `IDEMPOTENCY_KEY_CONFLICT` | 409 |
| `IDEMPOTENCY_PAYLOAD_MISMATCH` | 422 |

## Statuses

- `400` — Invalid request or business failure. Codes: EMPLOYEE_NOT_FOUND, CATEGORY_NOT_FOUND, INVALID_FILE_CONTENT, INVALID_EXPIRY_DATE
- `401` — Missing or invalid access token
- `403` — Not authorized
- `404` — Not found
- `409` — The Idempotency-Key is still being processed by another request.
- `422` — The Idempotency-Key was already used with a different request payload.
- `429` — Too many requests
- `500` — Internal server error