# Upload Attachment
> Upload document attachments for a merchant application (tax verification, bank statements, identity documents). **Content-Type**: `multipart/form-data` **Authentication**: `X-API-Key` header required **File Requirements**: - Maximum file size: 4MB - Supported formats: PDF, JPG, PNG - Supported Document Category Values: bank_verification, tax_verification, identity_verification, authorized_signatory_identity_verification, certified_authorized_signatory, control_person_identity_verification, address_verification
Source: https://help.boltapp.com/api-reference/merchant-onboarding/merchant-applications/upload-attachment
`POST /v1/merchant_applications/{merchant_application_id}/attachments`
## OpenAPI definition
This endpoint as it appears in the OpenAPI document, with every schema it references included.
```json
{
"openapi": "3.2.0",
"info": {
"title": "Bolt Connect Merchant Onboarding API",
"version": "1.0.0",
"description": "## Overview\nThis collection provides comprehensive access to Bolt's Platform Connected Merchant Onboarding APIs, designed to enable platform platforms to onboard their sub-merchants seamlessly. The APIs support two primary workflows:\n1. **Direct Onboarding**: Platforms can directly onboard sub-merchants using the merchant application APIs\n2. **Self-Onboarding**: Platforms can generate sharable links for sub-merchants to complete their own onboarding\n\n## API Workflow\nThe typical onboarding workflow follows these steps:\n1. **Get Public Key** (`GET /v1/merchant-application/public-key`):
\nRetrieve RSA public key for encrypting \nsensitive data\n2. **Create Application** (`POST /v1/merchant_applications`):
\nCreate a new merchant application with encrypted company information\n3. **Upload Attachments** (`POST /v1/merchant_applications/{id}/attachments`): Upload required documents (tax verification, bank statements, etc.)\n4. **Update Application** (`PUT /v1/merchant_applications/{id}`):
\nComplete the application with encrypted form submission\n5. **Generate Link** (Optional) (`POST /v1/merchant_applications/onboarding-link`):\nGenerate self-onboarding link for sub-merchants\n\n## Encryption\n Sensitive data in requests must be encrypted using RSA-4096 encryption with the public key obtained from the public key endpoint.\n\n ### Node.js encryption example\n ```javascript\n const crypto = require('crypto');\n const axios = require('axios');\n // Function to fetch public key and encrypt JSON payload\nasync function encryptPayload(baseUrl, apiKey, jsonPayload) {\n try {\n // Step 1: Fetch the public key\n const publicKeyResponse = await axios.get(`${baseUrl}/v1/merchant-application/public-key`);\n const publicKeyBase64 = publicKeyResponse.data.public_key;\n // Step 2: Decode the base64-encoded PEM public key\n const publicKeyPEM = Buffer.from(publicKeyBase64, 'base64').toString('utf8');\n // Step 3: Convert JSON payload to string\n const payloadString = JSON.stringify(jsonPayload);\n // Step 4: Encrypt the payload using RSA-OAEP with SHA-256\n const encryptedBuffer = crypto.publicEncrypt({\n key: publicKeyPEM,\n padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,\n oaepHash: 'sha256'\n }, Buffer.from(payloadString, 'utf8'));\n // Step 5: Encode the encrypted data as base64\n const encryptedPayloadBase64 = encryptedBuffer.toString('base64');\n return {\n encrypted_payload: encryptedPayloadBase64\n };\n } catch (error) {\n console.error('Encryption failed:', error);\n throw error;\n }\n}\n// Example usage:\nconst payload = {\n company_information: {\n email_address: \"company@example.com\",\n phone_number: \"+1234567890\",\n registered_address: {\n address_line1: \"123 Main St\",\n city: \"San Francisco\",\n state: \"CA\",\n zip: \"94105\",\n country: \"US\"\n },\n billing_address: {\n address_line1: \"123 Main St\",\n city: \"San Francisco\",\n state: \"CA\",\n zip: \"94105\",\n country: \"US\"\n },\n annual_processing_volume: 1000000,\n average_transaction_value: 5000,\n highest_transaction_value: 10000\n }\n};\n// Encrypt and send request\nencryptPayload('https://api.boltapp.com', 'your-api-key', payload)\n .then(encryptedData => {\n // Use encryptedData in your API request\n return axios.post(`${baseUrl}/v1/merchant_applications`, encryptedData, {\n headers: {\n 'Content-Type': 'application/json',\n 'X-API-Key': 'your-api-key'\n }\n });\n})\n.then(response => {\n console.log('Merchant application created:', response.data);\n})\n.catch(error => {\n console.error('Request failed:', error);\n});\n ```\n"
},
"servers": [
{
"url": "https://api.boltapp.com"
}
],
"paths": {
"/v1/merchant_applications/{merchant_application_id}/attachments": {
"post": {
"parameters": [
{
"name": "merchant_application_id",
"in": "path",
"required": true,
"description": "Identifier returned when the merchant application was created.",
"schema": {
"type": "string"
},
"examples": {
"default": {
"value": "scoped_merchant_app_id_12345"
}
}
}
],
"operationId": "upload_attachment",
"summary": "Upload Attachment",
"description": "Upload document attachments for a merchant application (tax verification,\nbank statements, identity documents).\n\n\n **Content-Type**: `multipart/form-data`\n\n**Authentication**: `X-API-Key` header required\n\n\n**File Requirements**:\n\n- Maximum file size: 4MB\n\n- Supported formats: PDF, JPG, PNG\n\n- Supported Document Category Values: bank_verification, tax_verification, identity_verification,\nauthorized_signatory_identity_verification, certified_authorized_signatory,\ncontrol_person_identity_verification, address_verification\n",
"responses": {
"200": {
"description": "Success Response",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"file_id": {
"type": "string"
}
},
"required": [
"file_id"
]
},
"examples": {
"Success Response": {
"value": {
"file_id": "scoped_file_id_67890"
}
}
}
}
}
},
"400": {
"description": "File Too Large Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ErrorResponse"
},
"examples": {
"File Too Large Error": {
"value": {
"errors": [
{
"code": 1000001,
"message": "File size too large. Maximum allowed is 4194304",
"field": "document_file"
}
]
}
}
}
}
}
},
"401": {
"description": "Unauthorized - Invalid or missing API key",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ErrorResponse"
},
"examples": {
"Unauthorized - Invalid or missing API key": {
"value": {
"errors": [
{
"code": 18,
"message": "This action is forbidden",
"field": ""
}
]
}
}
}
}
}
},
"404": {
"description": "Merchant application not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ErrorResponse"
},
"examples": {
"Merchant application not found": {
"value": {
"errors": [
{
"code": 24,
"message": "This action is forbidden",
"field": ""
}
]
}
}
}
}
}
},
"422": {
"description": "Invalid Supported Document Category Values Error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ErrorResponse"
},
"examples": {
"Invalid Supported Document Category Values Error": {
"value": {
"errors": [
{
"code": 1000001,
"message": "Supported Document Category Values [invalid_category] is not accepted",
"field": "supported_document_category_values"
}
]
}
}
}
}
}
}
},
"tags": [
"Merchant Applications"
],
"requestBody": {
"required": true,
"content": {
"multipart/form-data": {
"schema": {
"type": "object",
"properties": {
"document_file": {
"type": "string",
"description": "Document file (PDF, JPG, PNG) - Max 4MB",
"contentMediaType": "application/octet-stream"
},
"document_category": {
"type": "string",
"description": "Document type",
"enum": [
"bank_verification",
"tax_verification",
"identity_verification",
"authorized_signatory_identity_verification",
"certified_authorized_signatory",
"control_person_identity_verification",
"address_verification"
]
},
"page_tag": {
"type": "string",
"description": "Document page",
"enum": [
"front",
"back"
]
}
},
"required": [
"document_file",
"supported_document_category_values"
]
}
}
}
},
"security": [
{
"ApiKeyAuth": []
}
]
}
}
},
"components": {
"schemas": {
"ErrorResponse": {
"type": "object",
"properties": {
"errors": {
"type": "array",
"items": {
"type": "object",
"properties": {
"code": {
"type": "integer",
"description": "Numeric error code"
},
"message": {
"type": "string",
"description": "Human-readable error message"
},
"field": {
"type": "string",
"description": "Field related to the error, if applicable"
}
}
}
}
}
}
},
"securitySchemes": {
"ApiKeyAuth": {
"type": "apiKey",
"in": "header",
"name": "X-API-Key",
"description": "API key used to authorize requests for non-public endpoints."
}
}
}
}
```