Skip to main content
PATCH
curl
The presigned links in extra_files expire. Read fresh ones from the session decision when you need the files later. To correct the data extracted from a document instead, use Update session data.

Authorizations

x-api-key
string
header
required

Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys.

Path Parameters

sessionId
string<uuid>
required

UUID of the User Verification (KYC) session to add the file to (the session_id returned by POST /v3/session/). A Business Verification (KYB) session ID returns 404.

Example:

"11111111-2222-3333-4444-555555555555"

Body

multipart/form-data
file
file
required

The image or PDF. Allowed extensions: jpg, jpeg, png, webp, tiff, pdf. At most 15 MB as uploaded; the file is then compressed and rejected with 400 if it is still larger than 2 MB (2,097,152 bytes). Empty files are rejected.

model_type
enum<string>
required

kyc adds the file to the ID verification result, poa to the Proof of Address result.

Available options:
kyc,
poa
Example:

"kyc"

file_password
string

Password of an encrypted PDF. Without it, or with a wrong one, an encrypted PDF returns 400.

Response

File added. Returns every extra file of that result, including the new one.

extra_files
(string<uri> | null)[]
required

Short-lived presigned links to all extra files of the result named by model_type, oldest first. Each link is null for a scoped API key without media: read. Read fresh links from the session decision later.