# Lean - uploadDoc method

You can use this method to store documents linked to the issued disposable:

- the evidence of the identification
- signed contracts (eg. CA22D)
- audit log of the signature process


**Note:** If the disposable is issued with the [`enrollDisposableWitheIDAssertion`](/products/leandisposable/enterprise-documentation/developer-documentation/api-references/lean-enroll/lean-enroll-eid-assertion-method) method you **don't need** to upload the assertion with this method. In this case the assertion is automatically stored.

**For the full technical reference, see the  [OpenAPI specification](/products/leandisposable/openapi/document/uploaddoc)**.

REST API
#### Endpoint


```
POST /api/document/{lraId}/uploadDoc
```

#### Headers

| Name | Required | Description |
|  --- | --- | --- |
| `Content-Type` | Yes | Must be `application/json`. |
| `Authorization` | Yes | Basic Auth credentials. |


#### Path parameters

| Parameter | Type | Required | Description |
|  --- | --- | --- | --- |
| `lraId` | integer | Yes | LRA identifier. |


#### Body parameters

| Parameter | Type | Required | Description |
|  --- | --- | --- | --- |
| `deviceCode` | string | Yes | The device code of the issued certificate. |
| `idOtp` | integer | Yes | The OTP identification associated to the disposable. Use `0` if `otpType=NO_OTP`. |
| `typeDoc` | string | Yes | Document type. Allowed values: `IDENTIFICATION_DOC`, `CONTRACT`, `AUDIT_LOG`, `IDENTITY_ASSERTION`. |
| `extension` | string | Yes | File extension (not case-sensitive). Allowed: `pdf`, `zip`, `png`, `jpeg`, `jpg`, `docx`, `doc`, `odt`, `xml`, `json`, `txt`, `mp4`, `m4a`, `m4v`. |
| `file` | string | Yes | File content, base64 encoded. |
| `externalKey` | string | No | An external reference to the file. |


#### Request example


```json
{
    "idOtp": 2587763,
    "deviceCode": "RHIDP2412011111111",
    "externalKey": "external_key_sample",
    "file": "encoded base 64 file",
    "extension": "pdf",
    "typeDoc": "CONTRACT"
}
```

#### Response examples

**200 — Document uploaded**


```json
{
    "deviceCode": "RHIDP2412011111111",
    "typeDoc": "CONTRACT",
    "externalKey": "external_key_sample",
    "uploadDate": 1733496805136,
    "filename": "3333217_a4ece4b3e9626ccfd3bac2eb77c0c1d7950be77e190a64fcf1957279e677ffc7.pdf"
}
```

`uploadDate` is returned as a Unix timestamp in milliseconds (e.g. `1733496805136` = 2024-12-06T10:13:25Z).

SOAP API
The SOAP interface is deprecated. Use the REST API instead.

**Method:** uploadDoc

| **Parameter** | **Description** | **Mandatory** |
|  --- | --- | --- |
| lraid | The LRA identification code | YES |
| deviceCode | The device code of the issued certificate | YES |
| idOtp | The identification of the otp associate to the disposable (It should be 0 if the disposable has a `NO_OTP` otp type) | YES |
| typeDoc | The type of the document. Allowed values: - IDENTIFICATION_DOC- CONTRACT- AUDIT_LOG- IDENTITY_ASSERTION | YES |
| extension | The extension of the file. Allowed values (not case-sensitive): pdf, zip, png, jpeg/jpg, docx, doc, odt, xml, json, txt, mp4, m4a, m4v | YES |
| file | File | YES |
| externalKey | An external reference to the file | NO |


#### Request example


```xml
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.ws.nam/">
   <soapenv:Header/>
   <soapenv:Body>
      <ser:uploadDoc>      
      <lraid>111</lraid>
      <deviceCode>RHIDN00000001</deviceCode>
      <idOtp>202181</idOtp>
      <externalKey>external_key_sample</externalKey>
      <file>JVBERi0xLjMKJcTl8uXrp...</file>
      <extension>pdf</extension>
      <typeDoc>CONTRACT</typeDoc>
      </ser:uploadDoc>
   </soapenv:Body>
</soapenv:Envelope>
```

#### Response example


```xml
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Body>
        <ns2:uploadDocResponse xmlns:ns2="http://service.ws.nam/">
            <return>
                <deviceCode>RHIDN00000001</deviceCode>
                <externalKey>external_key_sample</externalKey>
                <filename>1639114_a4ece4b3e9626ccfd3bac2eb77c0c1d7950be77e190a64fcf1957279e677ffc7.pdf</filename>
                <typeDoc>CONTRACT</typeDoc>
                <uploadDate>2024-05-17T10:28:42.070+02:00</uploadDate>
            </return>
        </ns2:uploadDocResponse>
    </soap:Body>
</soap:Envelope>
```

#### Error codes

All errors below return HTTP `500`.

| Error code | Description |
|  --- | --- |
| [242](/products/leandisposable/enterprise-documentation/developer-documentation/integration-guide/lean-ig-how-to-handle-errors#error-242-input-parameter-invalid) | Input parameter invalid |
| [1027](/products/leandisposable/enterprise-documentation/developer-documentation/integration-guide/lean-ig-how-to-handle-errors#error-1027-the-document-is-duplicated) | The document is duplicated |
| [1028](/products/leandisposable/enterprise-documentation/developer-documentation/integration-guide/lean-ig-how-to-handle-errors#error-1028-the-file-exceeds-the-maximum-size-limit) | The file exceeds the maximum size limit |


Error code 242 is returned when an invalid parameter is passed. Examples:


```json
{
  "code": 242,
  "message": "deviceCode: should not be null"
}
```


```json
{
  "code": 242,
  "message": "extension: value 'docx' is not allowed"
}
```

The parameters that can trigger error 242 are: `deviceCode`, `lraid`, `idOtp`, `extension`, `typeDoc`.

For authentication errors, see [Authentication](/products/leandisposable/enterprise-documentation/developer-documentation/authentication).