---
description: "Get a URL to upload a document programmatically to add documents to KYC onboarding flows."
title: "Get Document Upload URL"
---

# Get Document Upload URL

> Get a URL to upload a document programmatically to add documents to KYC onboarding flows.

```http
GET /onboarding/{CustomerID}/prefill/documents/upload-url
```

- `https://api.sandbox.noah.com/v1/onboarding/{CustomerID}/prefill/documents/upload-url` — V1 Sandbox Server
- `https://api.noah.com/v1/onboarding/{CustomerID}/prefill/documents/upload-url` — V1 Production Server

## Authentication

- `X-Api-Key`: Your Noah API key. Required on all requests. See [API Keys](/api-concepts/authentication/api).
- `Api-Signature`: Digitally signed JWT used to verify request authenticity. Optional in sandbox when your API key has no associated signing public key; required in production for all requests. If sent, the signature is always validated. See [Request Signing](/api-concepts/authentication/signing).

## Path parameters

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `CustomerID` | string | Yes | Customer ID for the onboarding session. A unique ID which identifies the customer in the Business' internal system and in NOAH. (length 1-42) |

## Query parameters

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `Type` | `DrivingLicense` \| `NationalIDCard` \| `Passport` \| `UtilityBill` \| `SourceOfFunds` \| `ResidencePermit` \| `ForeignerID` \| `MemorandumAndArticles` \| `ShareholdersExtract` \| `RegistryExtract` \| `DirectorsExtract` \| `OngoingMonitoringProcedure` \| `PEPSanctionsAdverseMediaProcedure` \| `OnboardingKYCAndCIPProcedure` \| `CDDEDDProcedure` \| `SARSTRReportingProcedure` \| `AntiBriberyCorruptionProcedure` \| `AMLTrainingScheduleAndRecords` \| `CorporateShareholderExtract` \| `CertificateOfGoodStanding` \| `CompanyBankStatement` \| `BusinessSourceOfFunds` \| `AMLAuditReport` \| `AMLRemediationPlan` \| `AMLCTFEnterpriseRiskAssessment` \| `BusinessTaxId` \| `AmlCtfPolicy` \| `Selfie` \| `IncumbencyCertificate` \| `InformationStatement` \| `TrustAgreement` \| `BusinessPlan` | Yes | Document type. |
| `Side` | `Front` \| `Back` | No | Document side. |
| `CountryCode` | string | Yes | ISO 3166-1 alpha-2 country code. |
| `AssociateID` | string | No | The ID of the affiliated party associated with the document. (length 0-36) |

## Responses

### 200 — Document upload URL successfully created.

#### `application/json`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `PresignedURL` | string (uri) | Yes | URL to upload the document. |
| `ExpiresAt` | string (date-time) | Yes | DateTime the presigned URL expires. |

### 400 — Bad request

### 401 — Client is not authorized to perform this action

### 500 — Internal server error

Error responses share one `Error` envelope across the whole API. See https://docs.noah.com/api-concepts/errors.md for its fields, the `Type` values, and the field-level validation details in `RequestExtension` and `DenyExtension`.

## See also

- Rendered reference: https://docs.noah.com/api-reference/get-document-upload-url
- OpenAPI document: https://docs.noah.com/files/oas-schema.generated.json