---
title: "File upload requests"
description: "Collect a file from a customer or partner through a secure, time-limited upload link."
canonical: "https://studio.inttegro.com/api/file-uploads"
format: inttegro-machine-docs/v1
language: "PHP"
sdk_version: "v12.0.0"
reader_profile: optional
reader_manifest: "https://studio.inttegro.com/machine/php/readers/index.json"
reader_identification: "Optional: declare your client only if known and your current-session capabilities; use reader_manifest for supplemental recommendations."
preamble_estimated_tokens: 605
model_token_report: "https://studio.inttegro.com/machine/token-report.json"
preamble_questions: 5
preamble_source: "machine-only-decisions"
recommended_mcp_tools: ["upload_file"]
estimated_tokens: 8774
token_estimate_method: "utf8_bytes_divided_by_4"
---

## Machine preamble

**Summary:** Collect a file from a customer or partner through a secure, time-limited upload link. This PHP representation uses the selected SDK's native names wherever Studio has a verified mapping.

### Five questions

#### Q1. Is File upload requests the right source for this task?

Use this reference for collect a file from a customer or partner through a secure, time-limited upload link. Keep the four decision rules below with its exact operations and fields; do not infer a broader workflow from endpoint order.

#### Q2. What does “Use this API for an external uploader, not for a trusted server upload” require?

**Use this API for an external uploader, not for a trusted server upload.**
Your application creates one time-limited request for one file and shares its
upload link without sharing an API credential. For direct server uploads, use
[Files](https://studio.inttegro.com/machine/php/api/files.md).

#### Q3. What does “Do not stop at successful request creation” require?

**Do not stop at successful request creation.** Read [`upload_request.active`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html)to determine whether the link can still accept a file and wait for a fulfilled
state with a resulting[`upload_request.file_id`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html).

#### Q4. What does “Use attempt details to decide whether the same uploader can continue” require?

**Use attempt details to decide whether the same uploader can continue.** A
failed attempt does not necessarily mean the request itself is terminal;
inspect the attempt error, remaining attempt allowance, request status, and
expiry together.

#### Q5. What does “Continue with the file resource” require?

**Continue with the file resource.** Once fulfilled, use [Lookup a
file](https://studio.inttegro.com/machine/php/api/files.md#lookup-a-file) to verify availability and obtain the delivery
details appropriate to its purpose.

### Recommended MCP assistance

Use these through an authenticated Inttegro MCP connection. This document remains the contract source.

- [`upload_file`](https://studio.inttegro.com/machine/php/inttegro-mcp/tools.md#upload_file) — action; exact user confirmation required. Uploads canonical base64 file content up to 5 MiB and returns safe file metadata without echoing bytes or unrestricted custom data.

## Document content

# File upload requests

Upload requests let a customer, supplier, or other partner add a file to your Inttegro account through a secure, time-limited link. Your application creates the request and shares the link; the uploader sends the file directly to Inttegro without gaining access to your API credentials.

Use an upload request when someone outside your application needs to provide a product image, downloadable product, catalog import, video, or support document. Each request collects one file and produces a normal Inttegro file when the upload succeeds.

## Follow the upload-request handoff through to a usable file

The four decision rules are in the machine preamble above.

## The upload request object

An upload request records what file you expect, who should provide it, and whether it has arrived. New requests start as [`\Inttegro\UploadRequest\Status::Pending`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Pending); an accepted file changes the request to [`\Inttegro\UploadRequest\Status::Fulfilled`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Fulfilled) and sets [`upload_request.file_id`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html). A request can instead become [`\Inttegro\UploadRequest\Status::Failed`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Failed), [`\Inttegro\UploadRequest\Status::Expired`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Expired), or [`\Inttegro\UploadRequest\Status::Canceled`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Canceled).

Use [`upload_request.active`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) to decide whether the link can still accept a file. When a request is fulfilled, retrieve the resulting file through [Lookup a file](https://studio.inttegro.com/machine/php/api/files.md#lookup-a-file).

### Properties

- [`active`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `boolean`

  Whether the request can still accept an upload.

- [`attempt`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html)

  Most recent upload attempt. Lookup and upload responses include it after the uploader has tried to send a file.

  - [`attempt.attempted_at`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `timestamp`

    When the upload attempt started.

  - [`attempt.content_type`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Declared content type when present.

  - [`attempt.declared_size`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `integer`

    Declared file size in bytes when present.

  - [`attempt.error`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `object`

    Why the file was not accepted and whether the uploader may try again.

  - [`attempt.failed_at`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `timestamp`

    When a failed attempt completed.

  - [`attempt.file_id`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Resulting file ID after a successful attempt.

  - [`attempt.filename`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Submitted filename when present.

  - [`attempt.id`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Unique attempt identifier.

  - [`attempt.ordinal`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `integer`

    One-based attempt number for the request.

  - [`attempt.review`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `object`

    Your approval or rejection of the uploaded file, when reviewed.

  - [`attempt.status`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Attempt status such as `'succeeded'` or `'failed'`.

  - [`attempt.succeeded_at`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `timestamp`

    When a successful attempt completed.

  - [`attempt.upload_request_id`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Upload-request ID that owns the attempt.

- [`attempts`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html)

  Upload-attempt limit and current counts.

  - [`attempts.attempt_count`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `integer`

    Total upload attempts recorded for this request.

  - [`attempts.failed_attempt_count`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `integer`

    How many upload attempts have failed validation or fulfillment.

  - [`attempts.last_attempted_at`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `timestamp`

    When the most recent upload attempt happened.

  - [`attempts.max_attempts`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `integer`

    Maximum number of allowed failed attempts.

- [`canceled_at`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `timestamp`

  When the request was canceled. Returned only after cancellation.

- [`canceled_by`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html)

  Person or system that canceled the request. Present only after cancellation.

  - [`canceled_by.email`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Actor email when available.

  - [`canceled_by.id`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Actor ID when available.

  - [`canceled_by.name`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Actor display name when available.

  - [`canceled_by.service`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Service name when the request was canceled by an automated workflow.

  - [`canceled_by.type`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Kind of actor that canceled the request.

- [`constraints`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html)

  Optional file requirements that are stricter than the selected purpose.

  - [`constraints.content_types`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `array`

    Optional narrowed allow-list of MIME types.

  - [`constraints.exact_size`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `integer`

    Optional exact file size in bytes.

  - [`constraints.extensions`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `array`

    Optional narrowed allow-list of filename extensions.

  - [`constraints.filename`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Optional exact filename requirement.

  - [`constraints.max_size`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `integer`

    Optional maximum file size in bytes.

  - [`constraints.min_size`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `integer`

    Optional minimum file size in bytes.

- [`created_at`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `timestamp`

  When the upload request was created.

- [`custom_data`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `object`

  Optional string key-value custom data copied to the resulting file.

- [`display`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html)

  Human-facing copy shown to the uploader.

  - [`display.description`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Optional longer explanation of what should be uploaded.

  - [`display.help_text`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Optional supporting guidance for the uploader.

  - [`display.title`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Short title for the upload prompt.

- [`expired_at`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `timestamp`

  When the request was marked expired. Returned only after expiry is recorded.

- [`expires_at`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `timestamp`

  When the public upload URL stops accepting uploads.

- [`file_id`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

  Resulting file ID after a successful upload. Omitted until fulfillment succeeds.

- [`fulfilled_at`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `timestamp`

  When a valid upload produced the file. Returned only after fulfillment succeeds.

- [`id`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

  Unique upload-request identifier. IDs begin with `uplreq_`.

- [`latest_error`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html)

  Most recent validation or fulfillment error.

  - [`latest_error.at`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `timestamp`

    When the error was recorded.

  - [`latest_error.code`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Stable error code for the failure.

  - [`latest_error.message`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Human-readable error message.

  - [`latest_error.param`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Request field associated with the error when available.

  - [`latest_error.retryable`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `boolean`

    Whether the uploader can try again.

- [`metadata`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `object`

  Additional read-only details supplied by Inttegro. Use [`upload_request.custom_data`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) for your own data.

- [`purpose`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

  File purpose the upload must satisfy:`'product_download'` accepts PDF, ZIP, text, and CSV files up to 100 MiB.
  `'product_image'` accepts JPEG, PNG, and GIF images up to 10 MiB.
  `'product_video'` accepts MP4, WebM, and QuickTime video up to 250 MiB.
  `'products_import'` accepts a CSV catalog import up to 32 MiB and 10,000 product rows.
  `'support_document'` accepts PDF, JPEG, PNG, and text files up to 25 MiB.

- [`recipient`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html)

  Person expected to provide the file, when you want that context on the request.

  - [`recipient.email`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Recipient email when available.

  - [`recipient.id`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Recipient ID when available.

  - [`recipient.name`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Recipient display name when available.

  - [`recipient.type`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Recipient type such as `'customer'`, `'email'`, or `'user'`.

- [`requester`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html)

  Person or system that created the request. Inttegro identifies the caller from the API key unless you supply additional details.

  - [`requester.email`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Actor email when available.

  - [`requester.id`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Actor ID when available.

  - [`requester.name`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Actor display name when available.

  - [`requester.service`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Service name when the request came from an automated workflow.

  - [`requester.type`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Kind of actor that created the request.

- [`resource`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html)

  Order, product, case, or other resource that needs the file.

  - [`resource.id`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Resource ID.

  - [`resource.name`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Resource name when available.

  - [`resource.type`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Resource type.

- [`status`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

  Upload-request lifecycle status: [`\Inttegro\UploadRequest\Status::Pending`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Pending), [`\Inttegro\UploadRequest\Status::Uploading`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Uploading), [`\Inttegro\UploadRequest\Status::Fulfilled`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Fulfilled), [`\Inttegro\UploadRequest\Status::Expired`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Expired), [`\Inttegro\UploadRequest\Status::Canceled`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Canceled), or [`\Inttegro\UploadRequest\Status::Failed`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Failed).

- [`subject`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html)

  Person or resource that the requested file is about.

  - [`subject.email`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Subject email when available.

  - [`subject.id`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Subject ID when available.

  - [`subject.name`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Subject display name when available.

  - [`subject.type`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

    Subject type such as `'customer'`, `'case'`, or `'user'`.

- [`updated_at`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `timestamp`

  When the upload request was last updated.

- [`upload_url`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `string`

  Secure upload link returned only when you create the request. Share it only with the intended uploader; lookup, page, and cancel responses do not return it again.

- [`uploading_at`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) — `timestamp`

  When an upload attempt moved into active fulfillment. Returned only while or after an upload attempt has started.

When an attempt has been reviewed, [`upload_request.attempt.review`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) records the decision, the review time, an optional message for the uploader, and any structured reasons.

For `'products_import'`, every nonblank data row must contain at least these columns in order: `name`, `type`, `price_currency`, `price_value`, `reference`, `description`, `about`, `category`, `tax_code`, `unit_dimension`, `price_label`, `publish`, and `attributes`. An optional first header row may use those names in the same order. The file must contain between 1 and 10,000 data rows.

## Create an upload request

Create an upload request when another person or system should send the file directly to Inttegro. The response includes a secure [`upload_request.upload_url`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) that you can place behind a button, send in a message, or hand to another trusted system.

The `purpose` sets the kinds and maximum size of file Inttegro accepts. Use `constraints` only when this particular request should be stricter—for example, to accept only PDF support documents under 10 MiB.

### Request body

- `attempts` — wire-only

  Optional limit on failed upload attempts.

  - `attempts.max_attempts` — `integer` — wire-only

    Maximum number of allowed failed attempts. Defaults to `3`.

- `constraints` — wire-only

  Optional requirements for this upload. These can narrow, but not widen, the selected purpose.

  - `constraints.content_types` — `array` — wire-only

    Optional narrowed allow-list of MIME types.

  - `constraints.exact_size` — `integer` — wire-only

    Optional exact file size in bytes.

  - `constraints.extensions` — `array` — wire-only

    Optional narrowed allow-list of filename extensions.

  - `constraints.filename` — `string` — wire-only

    Optional exact filename requirement.

  - `constraints.max_size` — `integer` — wire-only

    Optional maximum file size in bytes.

  - `constraints.min_size` — `integer` — wire-only

    Optional minimum file size in bytes.

- `custom_data` — `object` — wire-only

  Optional string key-value data for your own reconciliation. Inttegro copies it to the resulting file. The object can be at most 25 KiB and each key at most 256 characters.

- `display` — wire-only

  Optional uploader-facing copy.

  - `display.description` — `string` — wire-only

    Optional longer description of what to upload.

  - `display.help_text` — `string` — wire-only

    Optional supporting guidance for the uploader.

  - `display.title` — `string` — wire-only

    Short title for the upload prompt.

- `expires_at` — `timestamp` — wire-only

  Optional RFC 3339 expiry. The default is 24 hours from creation.

- `purpose` — `string` — required — wire-only

  File purpose the upload must satisfy.

- `recipient` — wire-only

  Optional uploader identity details.

  - `recipient.email` — `string` — wire-only

    Recipient email when available.

  - `recipient.id` — `string` — wire-only

    Recipient ID when available.

  - `recipient.name` — `string` — wire-only

    Recipient display name when available.

  - `recipient.type` — `string` — wire-only

    Recipient type.

- `requester` — wire-only

  Optional details about the person or system creating the request. Normally, Inttegro identifies the caller from the API key.

  - `requester.email` — `string` — wire-only

    Actor email when available.

  - `requester.id` — `string` — wire-only

    Actor ID when available.

  - `requester.name` — `string` — wire-only

    Actor display name when available.

  - `requester.type` — `string` — wire-only

    Actor type.

- `resource` — wire-only

  Optional Inttegro resource or workflow that needs the file.

  - `resource.id` — `string` — wire-only

    Resource ID.

  - `resource.name` — `string` — wire-only

    Resource name when available.

  - `resource.type` — `string` — wire-only

    Resource type.

- `subject` — wire-only

  Optional person or Inttegro object the requested file is about.

  - `subject.email` — `string` — wire-only

    Subject email when available.

  - `subject.id` — `string` — wire-only

    Subject ID when available.

  - `subject.name` — `string` — wire-only

    Subject display name when available.

  - `subject.type` — `string` — wire-only

    Subject type.

### Upload limits

- The link expires after 24 hours unless you provide a future `expires_at`.
- The uploader gets three failed attempts unless you set `attempts.max_attempts`.
- File sizes are measured in bytes. Any minimum, maximum, or exact size must fit within the selected purpose's limit.
- Content types, extensions, and an exact filename can make a request more restrictive, but they cannot permit a file that the selected purpose rejects.

### Response

Returns the new upload request and its [`upload_request.upload_url`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html). Save the URL when you create the request because Inttegro does not return it again through lookup, page, or cancel.

Treat the URL like a temporary secret: anyone who has the complete URL can upload against the request. Use a stable idempotency key when retrying this call so that a network failure does not create multiple live links for the same upload.

**Request — POST /upload\_requests/create**

```php
<?php

use Inttegro\Client;

$client = new Client($_ENV['INTTEGRO_API_KEY']);
$result = $client->uploadRequests->create([
  'purpose' => 'support_document',
  'constraints' => [
    'content_types' => [
      'application/pdf',
    ],
    'max_size' => 10485760,
  ],
  'display' => [
    'title' => 'Upload dispute evidence',
    'help_text' => 'Attach a PDF under 10 MB.',
  ],
  'recipient' => [
    'type' => 'customer',
    'email' => 'ama@example.com',
  ],
  'resource' => [
    'type' => 'dispute',
    'id' => 'disp_123',
  ],
  'custom_data' => [
    'case_id' => 'CASE-1001',
  ],
  'expires_at' => '2030-07-06T12:30:00Z',
]);
```

```json
{
  "upload_request": {
    "id": "uplreq_1gK9pQ4vL8mN2sT5wX7yZ0",
    "purpose": "support_document",
    "status": "pending",
    "active": true,
    "upload_url": "<UPLOAD_URL>",
    "constraints": {
      "content_types": ["application/pdf"],
      "max_size": 10485760
    },
    "display": {
      "help_text": "Attach a PDF under 10 MB.",
      "title": "Upload dispute evidence"
    },
    "subject": {},
    "recipient": { "type": "customer", "email": "ama@example.com" },
    "resource": { "type": "dispute", "id": "disp_123" },
    "requester": { "type": "api_key" },
    "attempts": {
      "max_attempts": 3,
      "attempt_count": 0,
      "failed_attempt_count": 0
    },
    "custom_data": { "case_id": "CASE-1001" },
    "created_at": "2026-06-05T12:30:00Z",
    "updated_at": "2026-06-05T12:30:00Z",
    "expires_at": "2030-07-06T12:30:00Z"
  }
}
```

## Fulfill an upload request

Send the file as `multipart/form-data` to the complete upload link returned when the request was created. This call is made by the uploader and does not use your application's API key; the secure values needed to accept the upload are already part of the URL.

Use the URL exactly as returned. Do not extract, log, or reconstruct its query parameters.

### Included in the upload URL

- `id` — `string` — required — wire-only

  Identifies the upload request. It is already present in the generated upload
  link.

- `token` — `string` — required — wire-only

  Authorizes the upload. It is already present in the generated upload link
  and must remain private.

### Request body

- `file` — `file` — required — wire-only

  File selected by the uploader.

### Response

Returns the fulfilled upload request and a file receipt containing the resulting [`file.id`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadFulfillment.html). Your authenticated backend can pass that ID to [Lookup a file](https://studio.inttegro.com/machine/php/api/files.md#lookup-a-file) when it needs the complete file object.

If Inttegro rejects the file, the response includes an error and the failed attempt. Check `error.retryable` before offering another try. A retryable failure leaves the request pending while attempts remain; otherwise, create a new upload request.

Expired, canceled, fulfilled, and exhausted requests no longer accept uploads.

**Request — POST /upload\_requests/upload**

```php
<?php

use Inttegro\Client;

$client = new Client($_ENV['INTTEGRO_API_KEY']);
$result = $client->uploadRequests->fulfill([
    'upload_url' => '<UPLOAD_URL>',
    'file' => './evidence.pdf',
]);
```

## Lookup an upload request

Retrieve an upload request when you need its current status or the result of the uploader's latest attempt. After fulfillment, [`upload_request.file_id`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) identifies the file Inttegro created.

### Request body

- `id` — `string` — required

  Upload-request ID to retrieve.

### Response

Returns the upload request and its latest attempt, when one exists. The response does not include [`upload_request.upload_url`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html); retain that URL only for as long as the intended uploader needs it.

**Request — POST /upload\_requests/lookup**

```php
<?php

use Inttegro\Client;

$client = new Client($_ENV['INTTEGRO_API_KEY']);
$result = $client->uploadRequests->lookup("uplreq_1gK9pQ4vL8mN2sT5wX7yZ0");
```

## Review an upload attempt

Approve or reject the latest upload attempt after your application has checked the file itself—for example, after confirming that a document is readable or contains the requested evidence. Approval keeps a successful request fulfilled. Rejection reopens it for a replacement when another attempt is available.

### Request body

- `attempt_id` — `string` — wire-only

  Attempt ID to review. Supply exactly one of `attempt_id`
  or
  `attempt_ordinal`.

- `attempt_ordinal` — `integer` — wire-only

  One-based attempt number to review. Supply exactly one of
  `attempt_id` or
  `attempt_ordinal`.

- `decision` — `string` — required — wire-only

  Review decision: [`\Inttegro\UploadRequest\ReviewDecision::Approved`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-ReviewDecision.html#enumcase_Approved)
  or [`\Inttegro\UploadRequest\ReviewDecision::Rejected`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-ReviewDecision.html#enumcase_Rejected).

- `id` — `string` — required — wire-only

  Upload-request ID that owns the attempt.

- `public_message` — `string` — wire-only

  Optional explanation suitable for showing to the uploader.

- `reasons` — wire-only

  Optional structured reasons for the decision.

  - `reasons.code` — `string` — wire-only

    Required stable reason code.

  - `reasons.message` — `string` — wire-only

    Required customer-safe explanation.

  - `reasons.param` — `string` — wire-only

    Optional field associated with the reason.

Only the latest attempt can be reviewed. You can approve only a successful attempt, and you cannot review a canceled or expired request. Use `public_message` and `reasons` for explanations that are safe to show to the uploader.

### Response

Returns the updated upload request with the reviewed attempt. Use an idempotency key when submitting a review so a retry cannot record the decision twice.

**Request — POST /upload\_requests/review**

```php
<?php

use Inttegro\Client;

$client = new Client($_ENV['INTTEGRO_API_KEY']);
$result = $client->uploadRequests->review([
  'id' => 'uplreq_1gK9pQ4vL8mN2sT5wX7yZ0',
  'attempt_ordinal' => 1,
  'decision' => \Inttegro\UploadReviewDecision::Rejected,
  'reasons' => [
    [
      'code' => 'document_unreadable',
      'message' => 'The document is too blurry to read.',
    ],
  ],
  'public_message' => 'Please upload a clearer copy.',
], [
    'idempotency_key' => "review-upload-attempt-001",
]);
```

## Page upload requests

List upload requests when you need to find outstanding uploads, recent fulfillments, or requests associated with a particular order, product, case, or other resource.

### Request body

- `page_number` — `integer` — wire-only

  Page number to retrieve. Defaults to `1`.

- `page_size` — `integer` — wire-only

  Requested number of upload requests per page. Defaults to `25` and is capped at `256`.

- `purpose` — `string` — wire-only

  Optional purpose filter.

- `resource` — wire-only

  Optional resource filter.

  - `resource.id` — `string` — wire-only

    Resource ID.

  - `resource.name` — `string` — wire-only

    Resource name when available.

  - `resource.type` — `string` — wire-only

    Resource type.

- `status` — `string` — wire-only

  Optional status filter: [`\Inttegro\UploadRequest\Status::Pending`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Pending), [`\Inttegro\UploadRequest\Status::Uploading`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Uploading), [`\Inttegro\UploadRequest\Status::Fulfilled`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Fulfilled), [`\Inttegro\UploadRequest\Status::Expired`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Expired), [`\Inttegro\UploadRequest\Status::Canceled`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Canceled), or [`\Inttegro\UploadRequest\Status::Failed`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Failed).

### Response

Returns a page with [`page.upload_requests`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequestPage.html), [`page.number`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequestPage.html), and [`page.size`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequestPage.html). Page items omit the latest attempt; use [Lookup an upload request](#lookup-an-upload-request) when you need an attempt or its validation error. An empty page has an empty [`page.upload_requests`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequestPage.html) collection and [`page.size`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequestPage.html) set to `0`.

**Request — POST /upload\_requests/page**

```php
<?php

use Inttegro\Client;

$client = new Client($_ENV['INTTEGRO_API_KEY']);
$result = $client->uploadRequests->page([
  'purpose' => 'support_document',
  'status' => 'pending',
  'page_number' => 1,
  'page_size' => 25,
]);
```

## Cancel an upload request

Cancel a request when you no longer need the file or when you have issued a replacement link. Its upload URL stops working immediately.

### Request body

- `canceled_by` — wire-only

  Optional actor canceling the request.

  - `canceled_by.email` — `string` — wire-only

    Actor email when available.

  - `canceled_by.id` — `string` — wire-only

    Actor ID when available.

  - `canceled_by.name` — `string` — wire-only

    Actor display name when available.

  - `canceled_by.type` — `string` — wire-only

    Actor type.

- `id` — `string` — required — wire-only

  Upload-request ID to cancel.

### Response

Returns the request with [`upload_request.status`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest.html) set to [`\Inttegro\UploadRequest\Status::Canceled`](https://php.inttegro.dev/v12.0.0/classes/Inttegro-UploadRequest-Status.html#enumcase_Canceled). Use a stable idempotency key when retrying the cancellation.

**Request — POST /upload\_requests/cancel**

```php
<?php

use Inttegro\Client;

$client = new Client($_ENV['INTTEGRO_API_KEY']);
$result = $client->uploadRequests->cancel([
  'id' => 'uplreq_1gK9pQ4vL8mN2sT5wX7yZ0',
  'canceled_by' => [
    'type' => 'user',
    'id' => 'usr_support_123',
  ],
]);
```