Skip to content
bynhDocs
Log in

Upload an evidence file

POST/workspaces/{workspace}/evidence/items/{evidenceItem}/files

Attaches a file for your auditor. Adding a file also counts as collecting the evidence, so the next review date moves out.

Authentication

Send an API token as a bearer token. This endpoint needs a read and write token, made by an editor, admin or owner. Create one in My account → API tokens; see scopes and roles.

Authorization: Bearer 42|bynh_pat_•••••••Header

Path parameters

  • workspacestringRequired

    Your workspace slug, e.g. dokan.

  • evidenceItemintegerRequired

    Evidence item id.

Request body

multipart/form-data

  • fileenumRequiredmax 20480 KB (20 MB)

    Allowed extensions. The first bytes must match the extension (text types must be text), or it is refused. One of pdf, png, jpg, jpeg, csv, txt, json.

Response

201 Created

The stored file.

  • idintegerFile (document) id.
  • filenamestringSanitised original name.
  • mimeenumSet from the extension. One of application/pdf, image/png, image/jpeg, text/csv, text/plain, application/json.
  • sizeintegerBytes.
  • uploaded_bystring|nullUploader.
  • uploaded_atstringISO 8601.
  • download_pathstringRelative download path.

Rate limits

This endpoint counts toward your general limit of 120 requests a minute and its own limit of 20 a minute. Its own limit answers 429 without Retry-After; wait and try again.

Errors

401The token is missing, wrong, revoked or expired.
403The token is read-only (message: “This token is read-only. Create a read and write token to make changes.”). Or: The token’s owner is a viewer (“Viewers can read everything but can’t change it.”), or the workspace’s editing is paused (a billing message, e.g. “Your trial has ended, so editing is paused. …”).
404The token belongs to another workspace, or its owner is no longer a member.
422“Choose a file to upload.”, “The file didn’t upload. Try again, or pick a file under 20 MB.”, “The file must be 20 MB or smaller.”, “Upload a PDF, PNG, JPG, CSV, TXT or JSON file.”, or content mismatch “Upload a PDF, PNG, JPG, CSV, TXT or JSON file. This one doesn’t look like its type.”
429uploads limit (20/min).

Every error is JSON with a message. See Errors.

Next →Download an evidence file
curl -X POST "https://api.bynh.io/api/v1/workspaces/dokan/evidence/items/1/files" \
  -H "Authorization: Bearer $BYNH_TOKEN" \
  -H "Accept: application/json" \
  -F "file=@iam-users-2026-10-01.csv"

Response201 Created

application/json
{
  "data": {
    "id": 601,
    "filename": "iam-users-2026-10-01.csv",
    "mime": "text/csv",
    "size": 4821,
    "uploaded_by": "Faisal Alharbi",
    "uploaded_at": "2026-10-01T07:50:13+00:00",
    "download_path": "/workspaces/dokan/evidence/items/31/files/601/download"
  }
}

Examples use Dokan, a sample workspace. Responses are shortened where lists are long.