Upload Onboarding Files

curl --request POST \
  --url https://kyc.sbx.moduluslabs.io/v2/onboard/{merchantId}/files \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: multipart/form-data' \
  --form idsOfValidSignatories=@example-file \
  --form idsOfValidSignatoriesBack=@example-file \
  --form idsOfValidSignatoriesSignature=@example-file \
  --form mayorsOrBusinessPermit=@example-file \
  --form mayorsOrBusinessPermitBack=@example-file \
  --form mayorsOrBusinessPermitSignature=@example-file \
  --form birCert2303=@example-file \
  --form birCert2303Back=@example-file \
  --form birCert2303Signature=@example-file \
  --form secCert=@example-file \
  --form secCertBack=@example-file \
  --form secCertSignature=@example-file \
  --form gis=@example-file \
  --form gisBack=@example-file \
  --form gisSignature=@example-file \
  --form aoiAndByLaws=@example-file \
  --form aoiAndByLawsBack=@example-file \
  --form aoiAndByLawsSignature=@example-file \
  --form secretarysCert=@example-file \
  --form secretarysCertBack=@example-file \
  --form secretarysCertSignature=@example-file \
  --form barangayBusinessPermit=@example-file \
  --form barangayBusinessPermitBack=@example-file \
  --form barangayBusinessPermitSignature=@example-file \
  --form storePhoto=@example-file

import requests

url = "https://kyc.sbx.moduluslabs.io/v2/onboard/{merchantId}/files"

files = {
    "idsOfValidSignatories": ("example-file", open("example-file", "rb")),
    "idsOfValidSignatoriesBack": ("example-file", open("example-file", "rb")),
    "idsOfValidSignatoriesSignature": ("example-file", open("example-file", "rb")),
    "mayorsOrBusinessPermit": ("example-file", open("example-file", "rb")),
    "mayorsOrBusinessPermitBack": ("example-file", open("example-file", "rb")),
    "mayorsOrBusinessPermitSignature": ("example-file", open("example-file", "rb")),
    "birCert2303": ("example-file", open("example-file", "rb")),
    "birCert2303Back": ("example-file", open("example-file", "rb")),
    "birCert2303Signature": ("example-file", open("example-file", "rb")),
    "secCert": ("example-file", open("example-file", "rb")),
    "secCertBack": ("example-file", open("example-file", "rb")),
    "secCertSignature": ("example-file", open("example-file", "rb")),
    "gis": ("example-file", open("example-file", "rb")),
    "gisBack": ("example-file", open("example-file", "rb")),
    "gisSignature": ("example-file", open("example-file", "rb")),
    "aoiAndByLaws": ("example-file", open("example-file", "rb")),
    "aoiAndByLawsBack": ("example-file", open("example-file", "rb")),
    "aoiAndByLawsSignature": ("example-file", open("example-file", "rb")),
    "secretarysCert": ("example-file", open("example-file", "rb")),
    "secretarysCertBack": ("example-file", open("example-file", "rb")),
    "secretarysCertSignature": ("example-file", open("example-file", "rb")),
    "barangayBusinessPermit": ("example-file", open("example-file", "rb")),
    "barangayBusinessPermitBack": ("example-file", open("example-file", "rb")),
    "barangayBusinessPermitSignature": ("example-file", open("example-file", "rb")),
    "storePhoto": ("example-file", open("example-file", "rb"))
}
headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, files=files, headers=headers)

print(response.text)

const form = new FormData();
form.append('idsOfValidSignatories', '<string>');
form.append('idsOfValidSignatoriesBack', '<string>');
form.append('idsOfValidSignatoriesSignature', '<string>');
form.append('mayorsOrBusinessPermit', '<string>');
form.append('mayorsOrBusinessPermitBack', '<string>');
form.append('mayorsOrBusinessPermitSignature', '<string>');
form.append('birCert2303', '<string>');
form.append('birCert2303Back', '<string>');
form.append('birCert2303Signature', '<string>');
form.append('secCert', '<string>');
form.append('secCertBack', '<string>');
form.append('secCertSignature', '<string>');
form.append('gis', '<string>');
form.append('gisBack', '<string>');
form.append('gisSignature', '<string>');
form.append('aoiAndByLaws', '<string>');
form.append('aoiAndByLawsBack', '<string>');
form.append('aoiAndByLawsSignature', '<string>');
form.append('secretarysCert', '<string>');
form.append('secretarysCertBack', '<string>');
form.append('secretarysCertSignature', '<string>');
form.append('barangayBusinessPermit', '<string>');
form.append('barangayBusinessPermitBack', '<string>');
form.append('barangayBusinessPermitSignature', '<string>');
form.append('storePhoto', '<string>');

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

options.body = form;

fetch('https://kyc.sbx.moduluslabs.io/v2/onboard/{merchantId}/files', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://kyc.sbx.moduluslabs.io/v2/onboard/{merchantId}/files",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatories\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatoriesBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatoriesSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermit\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermitBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermitSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303Back\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303Signature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCert\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCertBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCertSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gis\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gisBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gisSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLaws\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLawsBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLawsSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCert\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCertBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCertSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermit\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermitBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermitSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"storePhoto\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: multipart/form-data"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://kyc.sbx.moduluslabs.io/v2/onboard/{merchantId}/files"

	payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatories\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatoriesBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatoriesSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermit\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermitBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermitSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303Back\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303Signature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCert\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCertBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCertSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gis\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gisBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gisSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLaws\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLawsBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLawsSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCert\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCertBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCertSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermit\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermitBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermitSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"storePhoto\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://kyc.sbx.moduluslabs.io/v2/onboard/{merchantId}/files")
  .header("Authorization", "Bearer <token>")
  .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatories\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatoriesBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatoriesSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermit\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermitBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermitSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303Back\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303Signature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCert\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCertBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCertSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gis\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gisBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gisSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLaws\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLawsBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLawsSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCert\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCertBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCertSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermit\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermitBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermitSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"storePhoto\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")
  .asString();

using RestSharp;


var options = new RestClientOptions("https://kyc.sbx.moduluslabs.io/v2/onboard/{merchantId}/files");
var client = new RestClient(options);
var request = new RestRequest("");
request.AlwaysMultipartFormData = true;
request.AddHeader("Authorization", "Bearer <token>");
request.FormBoundary = "---011000010111000001101001";
request.AddFile("idsOfValidSignatories", "example-file");
request.AddFile("idsOfValidSignatoriesBack", "example-file");
request.AddFile("idsOfValidSignatoriesSignature", "example-file");
request.AddFile("mayorsOrBusinessPermit", "example-file");
request.AddFile("mayorsOrBusinessPermitBack", "example-file");
request.AddFile("mayorsOrBusinessPermitSignature", "example-file");
request.AddFile("birCert2303", "example-file");
request.AddFile("birCert2303Back", "example-file");
request.AddFile("birCert2303Signature", "example-file");
request.AddFile("secCert", "example-file");
request.AddFile("secCertBack", "example-file");
request.AddFile("secCertSignature", "example-file");
request.AddFile("gis", "example-file");
request.AddFile("gisBack", "example-file");
request.AddFile("gisSignature", "example-file");
request.AddFile("aoiAndByLaws", "example-file");
request.AddFile("aoiAndByLawsBack", "example-file");
request.AddFile("aoiAndByLawsSignature", "example-file");
request.AddFile("secretarysCert", "example-file");
request.AddFile("secretarysCertBack", "example-file");
request.AddFile("secretarysCertSignature", "example-file");
request.AddFile("barangayBusinessPermit", "example-file");
request.AddFile("barangayBusinessPermitBack", "example-file");
request.AddFile("barangayBusinessPermitSignature", "example-file");
request.AddFile("storePhoto", "example-file");
var response = await client.PostAsync(request);

Console.WriteLine("{0}", response.Content);

{
  "files": [
    {
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "name": "<string>",
      "fileType": "<string>"
    }
  ]
}

{
  "statusCode": 123,
  "message": "<string>",
  "error": "<string>",
  "details": {}
}

{
  "statusCode": 123,
  "message": "<string>",
  "error": "<string>",
  "details": {}
}

POST

onboard

{merchantId}

files

Upload Onboarding Files

curl --request POST \
  --url https://kyc.sbx.moduluslabs.io/v2/onboard/{merchantId}/files \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: multipart/form-data' \
  --form idsOfValidSignatories=@example-file \
  --form idsOfValidSignatoriesBack=@example-file \
  --form idsOfValidSignatoriesSignature=@example-file \
  --form mayorsOrBusinessPermit=@example-file \
  --form mayorsOrBusinessPermitBack=@example-file \
  --form mayorsOrBusinessPermitSignature=@example-file \
  --form birCert2303=@example-file \
  --form birCert2303Back=@example-file \
  --form birCert2303Signature=@example-file \
  --form secCert=@example-file \
  --form secCertBack=@example-file \
  --form secCertSignature=@example-file \
  --form gis=@example-file \
  --form gisBack=@example-file \
  --form gisSignature=@example-file \
  --form aoiAndByLaws=@example-file \
  --form aoiAndByLawsBack=@example-file \
  --form aoiAndByLawsSignature=@example-file \
  --form secretarysCert=@example-file \
  --form secretarysCertBack=@example-file \
  --form secretarysCertSignature=@example-file \
  --form barangayBusinessPermit=@example-file \
  --form barangayBusinessPermitBack=@example-file \
  --form barangayBusinessPermitSignature=@example-file \
  --form storePhoto=@example-file

import requests

url = "https://kyc.sbx.moduluslabs.io/v2/onboard/{merchantId}/files"

files = {
    "idsOfValidSignatories": ("example-file", open("example-file", "rb")),
    "idsOfValidSignatoriesBack": ("example-file", open("example-file", "rb")),
    "idsOfValidSignatoriesSignature": ("example-file", open("example-file", "rb")),
    "mayorsOrBusinessPermit": ("example-file", open("example-file", "rb")),
    "mayorsOrBusinessPermitBack": ("example-file", open("example-file", "rb")),
    "mayorsOrBusinessPermitSignature": ("example-file", open("example-file", "rb")),
    "birCert2303": ("example-file", open("example-file", "rb")),
    "birCert2303Back": ("example-file", open("example-file", "rb")),
    "birCert2303Signature": ("example-file", open("example-file", "rb")),
    "secCert": ("example-file", open("example-file", "rb")),
    "secCertBack": ("example-file", open("example-file", "rb")),
    "secCertSignature": ("example-file", open("example-file", "rb")),
    "gis": ("example-file", open("example-file", "rb")),
    "gisBack": ("example-file", open("example-file", "rb")),
    "gisSignature": ("example-file", open("example-file", "rb")),
    "aoiAndByLaws": ("example-file", open("example-file", "rb")),
    "aoiAndByLawsBack": ("example-file", open("example-file", "rb")),
    "aoiAndByLawsSignature": ("example-file", open("example-file", "rb")),
    "secretarysCert": ("example-file", open("example-file", "rb")),
    "secretarysCertBack": ("example-file", open("example-file", "rb")),
    "secretarysCertSignature": ("example-file", open("example-file", "rb")),
    "barangayBusinessPermit": ("example-file", open("example-file", "rb")),
    "barangayBusinessPermitBack": ("example-file", open("example-file", "rb")),
    "barangayBusinessPermitSignature": ("example-file", open("example-file", "rb")),
    "storePhoto": ("example-file", open("example-file", "rb"))
}
headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, files=files, headers=headers)

print(response.text)

const form = new FormData();
form.append('idsOfValidSignatories', '<string>');
form.append('idsOfValidSignatoriesBack', '<string>');
form.append('idsOfValidSignatoriesSignature', '<string>');
form.append('mayorsOrBusinessPermit', '<string>');
form.append('mayorsOrBusinessPermitBack', '<string>');
form.append('mayorsOrBusinessPermitSignature', '<string>');
form.append('birCert2303', '<string>');
form.append('birCert2303Back', '<string>');
form.append('birCert2303Signature', '<string>');
form.append('secCert', '<string>');
form.append('secCertBack', '<string>');
form.append('secCertSignature', '<string>');
form.append('gis', '<string>');
form.append('gisBack', '<string>');
form.append('gisSignature', '<string>');
form.append('aoiAndByLaws', '<string>');
form.append('aoiAndByLawsBack', '<string>');
form.append('aoiAndByLawsSignature', '<string>');
form.append('secretarysCert', '<string>');
form.append('secretarysCertBack', '<string>');
form.append('secretarysCertSignature', '<string>');
form.append('barangayBusinessPermit', '<string>');
form.append('barangayBusinessPermitBack', '<string>');
form.append('barangayBusinessPermitSignature', '<string>');
form.append('storePhoto', '<string>');

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

options.body = form;

fetch('https://kyc.sbx.moduluslabs.io/v2/onboard/{merchantId}/files', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://kyc.sbx.moduluslabs.io/v2/onboard/{merchantId}/files",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatories\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatoriesBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatoriesSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermit\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermitBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermitSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303Back\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303Signature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCert\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCertBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCertSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gis\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gisBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gisSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLaws\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLawsBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLawsSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCert\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCertBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCertSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermit\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermitBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermitSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"storePhoto\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: multipart/form-data"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://kyc.sbx.moduluslabs.io/v2/onboard/{merchantId}/files"

	payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatories\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatoriesBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatoriesSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermit\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermitBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermitSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303Back\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303Signature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCert\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCertBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCertSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gis\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gisBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gisSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLaws\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLawsBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLawsSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCert\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCertBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCertSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermit\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermitBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermitSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"storePhoto\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://kyc.sbx.moduluslabs.io/v2/onboard/{merchantId}/files")
  .header("Authorization", "Bearer <token>")
  .body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatories\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatoriesBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"idsOfValidSignatoriesSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermit\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermitBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"mayorsOrBusinessPermitSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303Back\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"birCert2303Signature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCert\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCertBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secCertSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gis\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gisBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"gisSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLaws\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLawsBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"aoiAndByLawsSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCert\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCertBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"secretarysCertSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermit\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermitBack\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"barangayBusinessPermitSignature\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"storePhoto\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001--")
  .asString();

using RestSharp;


var options = new RestClientOptions("https://kyc.sbx.moduluslabs.io/v2/onboard/{merchantId}/files");
var client = new RestClient(options);
var request = new RestRequest("");
request.AlwaysMultipartFormData = true;
request.AddHeader("Authorization", "Bearer <token>");
request.FormBoundary = "---011000010111000001101001";
request.AddFile("idsOfValidSignatories", "example-file");
request.AddFile("idsOfValidSignatoriesBack", "example-file");
request.AddFile("idsOfValidSignatoriesSignature", "example-file");
request.AddFile("mayorsOrBusinessPermit", "example-file");
request.AddFile("mayorsOrBusinessPermitBack", "example-file");
request.AddFile("mayorsOrBusinessPermitSignature", "example-file");
request.AddFile("birCert2303", "example-file");
request.AddFile("birCert2303Back", "example-file");
request.AddFile("birCert2303Signature", "example-file");
request.AddFile("secCert", "example-file");
request.AddFile("secCertBack", "example-file");
request.AddFile("secCertSignature", "example-file");
request.AddFile("gis", "example-file");
request.AddFile("gisBack", "example-file");
request.AddFile("gisSignature", "example-file");
request.AddFile("aoiAndByLaws", "example-file");
request.AddFile("aoiAndByLawsBack", "example-file");
request.AddFile("aoiAndByLawsSignature", "example-file");
request.AddFile("secretarysCert", "example-file");
request.AddFile("secretarysCertBack", "example-file");
request.AddFile("secretarysCertSignature", "example-file");
request.AddFile("barangayBusinessPermit", "example-file");
request.AddFile("barangayBusinessPermitBack", "example-file");
request.AddFile("barangayBusinessPermitSignature", "example-file");
request.AddFile("storePhoto", "example-file");
var response = await client.PostAsync(request);

Console.WriteLine("{0}", response.Content);

{
  "files": [
    {
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "name": "<string>",
      "fileType": "<string>"
    }
  ]
}

{
  "statusCode": 123,
  "message": "<string>",
  "error": "<string>",
  "details": {}
}

{
  "statusCode": 123,
  "message": "<string>",
  "error": "<string>",
  "details": {}
}

Overview

Uploads business documents required for merchant onboarding and KYC (Know Your Customer) verification. This endpoint accepts multiple document types including valid IDs, business permits, certificates, and supporting documents.

Binary File Upload Required: This endpoint expects actual binary file content via multipart/form-data. Do NOT send base64-encoded strings, file paths, or URLs. Upload the actual file data using proper multipart form encoding.

Security: This endpoint implements OWASP File Upload Cheat Sheet best practices including file extension validation, MIME type validation, content validation using magic bytes, file size limits, and secure storage with randomized file names.

Authentication

This endpoint requires JWT Bearer Token authentication.

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Authorization Rules

User Role	Allowed Actions
Regular User/Merchant	Can only upload files for their own account (merchantId must match authenticated user)

Security Features

This endpoint implements OWASP File Upload Cheat Sheet best practices:

Extension Validation

Only .jpg, .jpeg, .png, .pdf extensions allowed

MIME Type Validation

Validates Content-Type header matches allowed types

Magic Bytes Validation

Uses file-type library to detect actual file content

File Size Limits

Maximum 25MB per file to prevent DoS attacks

File Name Sanitization

Strips dangerous characters from file names

Secure Storage

Files are stored with randomized names to prevent path traversal

Use Cases

Initial Document Upload

Upload required documents when first creating an onboarding application

Document Updates

Replace or add documents after application has been declined

Additional Documents

Submit supplementary documents requested by compliance team

Document Corrections

Re-upload documents with better quality or correct information

Troubleshooting

Sending Strings Instead of Binary Files

Error: No files received or Invalid file content typeIssue: Sending file paths, URLs, or base64-encoded strings instead of actual binary file dataIncorrect Examples:

//  WRONG - Sending file path as string
formData.append('idsOfValidSignatories', '/path/to/file.jpg');

//  WRONG - Sending base64 string
formData.append('idsOfValidSignatories', 'data:image/jpeg;base64,/9j/4AAQ...');

//  WRONG - Sending URL
formData.append('idsOfValidSignatories', 'https://example.com/file.jpg');

Correct Examples:

//  CORRECT - Node.js with file stream
const fs = require('fs');
formData.append('idsOfValidSignatories',
  fs.createReadStream('/path/to/file.jpg'));

//  CORRECT - Browser with File object
const fileInput = document.getElementById('fileInput');
formData.append('idsOfValidSignatories', fileInput.files[0]);

//  CORRECT - Python with file handle
files = {'idsOfValidSignatories': open('/path/to/file.jpg', 'rb')}

//  CORRECT - PHP with CURLFile
$file = new CURLFile('/path/to/file.jpg', 'image/jpeg', 'file.jpg');

Solution: Always use proper file upload mechanisms that send binary data, not text representations

Magic Bytes Validation Failure

Error: Invalid file content typeIssue: File extension doesn’t match actual file contentCommon Causes:

Renamed file with wrong extension (e.g., .txt renamed to .jpg)
Corrupted file
File created by unsupported software

Solution:

Use legitimate image editing or PDF software
Don’t just rename file extensions
Verify file opens correctly before uploading
Try converting file to correct format using standard tools

File Too Large Even After Compression

Error: File size exceeds 25MB limitSolutions:

For PDFs: Split multi-page documents across front/back/signature fields
For images: Reduce resolution (1920px width is usually sufficient)
For images: Convert to JPEG with 80-85% quality
For images: Use online compression tools like TinyPNG or Squoosh
Consider splitting document into multiple logical files

Multipart Form Data Encoding Issues

Issue: Files not being received by server or showing as undefinedSolutions for Different Languages:Node.js:

// Use form-data package, not URLSearchParams
const FormData = require('form-data');
const form = new FormData();
form.append('idsOfValidSignatories', fs.createReadStream(filePath));

// Include form headers
axios.post(url, form, {
  headers: {
    'Authorization': `Bearer ${token}`,
    ...form.getHeaders()  // Important!
  }
});

Python:

# Let requests handle Content-Type header
files = {'idsOfValidSignatories': open(file_path, 'rb')}
headers = {'Authorization': f'Bearer {token}'}
# Don't set Content-Type manually
requests.post(url, headers=headers, files=files)

PHP:

// Use CURLFile, not @ syntax (deprecated)
$file = new CURLFile($filePath, 'image/jpeg', 'filename.jpg');

File Name Sanitization Concerns

Issue: Uploaded file name doesn’t match originalExplanation: File names are sanitized for security:

Special characters removed
Path traversal sequences removed (../, ..)
Length truncated to 255 characters

Best Practice:

Use simple, descriptive file names
Avoid special characters
Use the returned id field to reference files, not name
Store your own mapping of file IDs to original names if needed

Document Checklist

Use this checklist to ensure you have all required documents before uploading:

Next Steps

Onboard Merchant

Submit onboarding application after uploading files

Retrieve Onboarding Status

Check onboarding application status

Update Onboarding Data

Update declined application with corrected documents

Error Handling

Complete error code reference

Authorizations

Authorization

string

header

required

JWT Bearer token authentication

Path Parameters

merchantId

string

required

The merchant's account ID (numeric string)

Pattern: ^\d+$

Body

multipart/form-data

idsOfValidSignatories

file

Valid government-issued IDs of authorized signatories (front side)

idsOfValidSignatoriesBack

file

Back side of valid IDs

idsOfValidSignatoriesSignature

file

Signature specimen from valid IDs

mayorsOrBusinessPermit

file

Mayor's Permit or Business Permit (front)

mayorsOrBusinessPermitBack

file

Back side of Mayor's/Business Permit

mayorsOrBusinessPermitSignature

file

Signature page of Mayor's/Business Permit

birCert2303

file

BIR Certificate of Registration (Form 2303) - front

birCert2303Back

file

Back side of BIR Certificate 2303

birCert2303Signature

file

Signature page of BIR Certificate 2303

secCert

file

SEC Certificate - front

secCertBack

file

Back side of SEC Certificate

secCertSignature

file

Signature page of SEC Certificate

gis

file

General Information Sheet - front

gisBack

file

Back side of GIS

gisSignature

file

Signature page of GIS

aoiAndByLaws

file

Articles of Incorporation and By-Laws - front

aoiAndByLawsBack

file

Back side of AOI and By-Laws

aoiAndByLawsSignature

file

Signature page of AOI and By-Laws

secretarysCert

file

Secretary's Certificate - front

secretarysCertBack

file

Back side of Secretary's Certificate

secretarysCertSignature

file

Signature page of Secretary's Certificate

barangayBusinessPermit

file

Barangay Business Permit - front

barangayBusinessPermitBack

file

Back side of Barangay Business Permit

barangayBusinessPermitSignature

file

Signature page of Barangay Business Permit

storePhoto

file

Photo of the store/business establishment (must show visible store name)

Response

Files uploaded successfully

files

object[]

List of successfully uploaded files

Show child attributes

QR API

Webhooks API

Onboarding API

Transaction Reporting API

Terminal Gateway API

Ecom API

Upload Onboarding Files

Overview

Authentication

Authorization Rules

Security Features

Extension Validation

MIME Type Validation

Magic Bytes Validation

File Size Limits

File Name Sanitization

Secure Storage

Use Cases

Initial Document Upload

Document Updates

Additional Documents

Document Corrections

Troubleshooting

Document Checklist

Next Steps

Onboard Merchant

Retrieve Onboarding Status

Update Onboarding Data

Error Handling

Authorizations

Path Parameters

Body

Response