> ## Documentation Index > Fetch the complete documentation index at: https://docs.didit.me/llms.txt > Use this file to discover all available pages before exploring further. # Upload KYB Documents API > Upload corporate documents to a Business Verification session from your own server, with the hosted pipeline's OCR and checks. ## OpenAPI ````yaml POST /v3/session/{sessionId}/kyb/documents/ openapi: 3.0.0 info: version: 3.0.0 title: Didit Verification API description: Identity verification API. Authenticate with x-api-key header. servers: - url: https://verification.didit.me security: [] tags: [] paths: /v3/session/{sessionId}/kyb/documents/: post: tags: - Sessions summary: Upload KYB documents to a session description: >- Upload one or more corporate documents (articles of incorporation, shareholder register, certificate of incorporation, ...) to the KYB Documents step of a Business Verification session, from your own server instead of the hosted page. Didit runs the hosted pipeline: compression, OCR, tampering and cross-document checks, document grouping, and advances the session when the required document groups are satisfied. The step costs one flat fee however many files you send. The session must be open and on the KYB Documents step, and the company chosen at the registry step must exist. Read the people the documents name with `GET /v3/session/{sessionId}/kyb/extracted-parties/`. Requires `write:businesses`. operationId: post_v3_session_kyb_documents parameters: - name: sessionId in: path required: true description: >- UUID of the Business Verification (KYB) session. It must belong to the application of the API key. schema: type: string format: uuid example: 33333333-4444-5555-6666-777777777777 - name: node_id in: query required: false description: >- Workflow node of the KYB step. Only needed when the workflow has more than one KYB node; by default Didit uses the session's own node. schema: type: string requestBody: required: true content: multipart/form-data: schema: type: object required: - documents properties: documents: type: array items: type: string format: binary description: >- Files to upload: JPG, JPEG, PNG, TIFF, WEBP, PDF or ZIP archives of them. PDFs up to 50 MB, photos up to 6 MB before compression. document_passwords: type: array items: type: string description: >- One entry per file in `documents`, in the same order: the password of a protected PDF, empty for any other file. document_group: type: string enum: - LEGAL_PRESENCE - COMPANY_DETAILS - OWNERSHIP_STRUCTURE - REPRESENTATIVES_AUTHORIZATION description: Required document group this upload answers. locale: type: string maxLength: 10 description: Locale used to translate the response of the next step. responses: '200': description: >- Documents processed. When every required group is satisfied the session advances and `next_step` names the next step; otherwise it stays on the Documents step and `document_groups` and `document_answer` say what is still missing. content: application/json: schema: type: object properties: valid: type: boolean next_step: type: string nullable: true description: Step the session is on after the upload. kyb_status: type: string description: Status of the company check. document_answer: type: object additionalProperties: true description: Result per uploaded document and the uploads left. additionalProperties: true example: valid: true next_step: KYB_KEY_PEOPLE kyb_status: In Progress '400': description: >- A document was rejected (tampering, unreadable or unsupported) or the session has no KYB company yet. Retry with another file while attempts remain. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. example: message: No KYB company found. Submit company data first. '401': description: >- The scoped API key has expired. This is the only case that returns `401`: a missing, invalid or revoked key returns `403`. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Expired key: summary: The key's expiry date has passed value: detail: This API key has expired. '402': description: The organization has no credit left for the documents step. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. example: detail: Insufficient credits. '403': description: >- Authentication or authorization failure. Missing, invalid and revoked keys return `403` (not `401`); so do a key of another application, a scoped key without the permission this endpoint needs, and a request from outside the key's IP allowlist. Distinguish them by `detail`. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Missing or invalid credentials: summary: No x-api-key header, or the key failed validation value: detail: >- Authentication credentials were not provided or are invalid. Other application: summary: >- A valid key that belongs to a different application than the session value: detail: You do not have permission to perform this action. Scoped key without decisions write: summary: 'Scoped key lacks decisions: write' value: detail: This API key has no write access to decisions. IP not allowed: summary: Request from outside the key's IP allowlist value: detail: This API key can't be used from this IP address. '404': description: >- The session does not exist, was deleted, belongs to another application or is outside a scoped key's limits; no detail distinguishes them. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. example: detail: Session not found. '409': description: >- The session is finished (`kyb_session_not_writable`) or is not on the KYB Documents step (`kyb_step_mismatch`, with `next_step` naming the step it is on). content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. code: type: string next_step: type: string example: detail: The session is not on the step this operation completes. code: kyb_step_mismatch next_step: KYB_REGISTRY '429': description: >- Rate limit exceeded: 300 write (POST, PATCH, DELETE) requests per minute per API key. Wait `Retry-After` seconds before retrying; the `X-RateLimit-*` headers show the budget. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Rate limited: summary: Budget for the current minute exhausted value: detail: >- Write request rate limit exceeded. You can make up to 300 requests per minute. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 1 example: 30 security: - ApiKeyAuth: [] x-codeSamples: - lang: python label: Python source: |- from didit import Didit # Reads DIDIT_API_KEY. client = Didit() result = client.sessions.upload_kyb_documents( "33333333-4444-5555-6666-777777777777", documents=[open("document.pdf", "rb")], ) print(result) - lang: javascript label: Node.js source: >- import Didit, { fileFromPath } from "@didit-protocol/sdk-node"; // Reads DIDIT_API_KEY. const didit = new Didit(); const result = await didit.sessions.uploadKybDocuments("33333333-4444-5555-6666-777777777777", { documents: [await fileFromPath("document.pdf")], }); console.log(result); - lang: go label: Go source: "ctx := context.Background()\n// Reads DIDIT_API_KEY.\nclient := didit.NewClient()\n\nresult, err := client.Sessions.UploadKYBDocuments(ctx, \"33333333-4444-5555-6666-777777777777\", didit.SessionsUploadKYBDocumentsParams{\n\tDocuments: []didit.File{didit.FileFromPath(\"document.pdf\")},\n})\nif err != nil {\n\tlog.Fatal(err)\n}\nfmt.Printf(\"%+v\\n\", result)" - lang: java label: Java source: >- import java.nio.file.Path; import java.util.List; import me.didit.Didit; import me.didit.types.SessionsUploadKybDocumentsParams; // Reads DIDIT_API_KEY. Didit client = new Didit(); var result = client.sessions().uploadKybDocuments("33333333-4444-5555-6666-777777777777", SessionsUploadKybDocumentsParams.builder() .documents(List.of(Path.of("document.pdf"))) .build()); System.out.println(result); - lang: php label: PHP source: >- sessions->uploadKybDocuments('33333333-4444-5555-6666-777777777777', [ 'documents' => [File::fromPath('document.pdf')], ]); print_r($result->toArray()); - lang: ruby label: Ruby source: |- require "didit" # Reads DIDIT_API_KEY. didit = Didit::Client.new result = didit.sessions.upload_kyb_documents( "33333333-4444-5555-6666-777777777777", documents: [Pathname("document.pdf")] ) puts result.to_h - lang: csharp label: .NET source: >- using System; using System.Text.Json; using Didit; // Reads DIDIT_API_KEY. using var client = new DiditClient(); var result = await client.Sessions.UploadKybDocumentsAsync("33333333-4444-5555-6666-777777777777", new SessionsUploadKybDocumentsParams { Documents = new FileUpload[] { FileUpload.FromPath("document.pdf") }, }); Console.WriteLine(JsonSerializer.Serialize(result)); components: securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.