Upload a certificate document

POST/workspaces/{workspace}/certificates/{certificate}/documents

Attaches a PDF to a certificate and sets who can read it on your trust center. The file must really be a PDF: its first bytes are checked.

Authentication

Send an API token as a bearer token. This endpoint needs a read and write token, made by an editor, admin or owner. Create one in My account → API tokens; see scopes and roles.

Authorization: Bearer 42|bynh_pat_•••••••Header

Path parameters

workspacestringRequired
Your workspace slug, e.g. dokan.
certificateintegerRequired
Certificate id.

Request body

multipart/form-data

filestringRequiredmax 20480 KB (20 MB)
PDF only (mimes:pdf and mimetypes:application/pdf; the content must start with %PDF-).
visibilityenumRequired
public: anyone; nda: after an NDA; private: only your team. One of public, nda, private.
titlestring, nullablemax 160
Display title. Defaults to the filename without extension.

Response

201 Created

The stored document.

idintegerDocument id.
titlestringDisplay title (defaults to the filename without extension).
filenamestringOriginal filename, sanitised.
sizeintegerBytes.
pagesinteger|nullBest-guess page count.
visibilityenumWho can read it on the trust center. One of public, nda, private.
visibility_labelstringLocalized label.
uploaded_bystring|nullUploader’s name. Omitted when the uploader wasn’t loaded (the create-certificate response).
uploaded_atstringISO 8601.
download_pathstringPath relative to the API base, e.g. /workspaces/dokan/documents/412/download.

Rate limits

This endpoint counts toward your general limit of 120 requests a minute and its own limit of 20 a minute. Its own limit answers 429 without Retry-After; wait and try again.

Errors

401The token is missing, wrong, revoked or expired.

403The token is read-only (message: “This token is read-only. Create a read and write token to make changes.”). Or: The token’s owner is a viewer (“Viewers can read everything but can’t change it.”), or the workspace’s editing is paused (a billing message, e.g. “Your trial has ended, so editing is paused. …”).

404The token belongs to another workspace, or its owner is no longer a member.

422Missing file (“Choose a PDF to upload.”), not a PDF (“Upload the certificate as a PDF.”), over 20 MB (“The PDF must be 20 MB or smaller.”), or bad visibility.

429More than 20 uploads a minute (“Too many attempts. Wait a few minutes, then try again.”), no Retry-After header.

Every error is JSON with a message. See Errors.

Next →List expiry reminders

curl -X POST "https://api.bynh.io/api/v1/workspaces/dokan/certificates/1/documents" \ -H "Authorization: Bearer $BYNH_TOKEN" \ -H "Accept: application/json" \ -F "file=@iso-27001-certificate.pdf" \ -F "visibility=public" \ -F "title=ISO 27001 certificate 2025"

{ "data": { "id": 412, "title": "ISO 27001 certificate 2025", "filename": "ISO 27001 certificate 2025.pdf", "size": 284113, "pages": 2, "visibility": "public", "visibility_label": "Public", "uploaded_by": "Sara Alqahtani", "uploaded_at": "2026-03-12T09:41:07+00:00", "download_path": "/workspaces/dokan/documents/412/download" } }