Attachments

The upload flow

One PDF per deposit request, ≤5 MiB. Bytes go to object storage through a presigned, write-once PUT; the object is scanned, hashed by Payday, and admitted by finalize. The hash is committed into the deposit address.

ClientPayday APIObject storagePOST /v1/attachments { filename }201 { id, upload_url, headers }PUT bytes, headers verbatimscan resultPOST /v1/attachments/{id}/finalize200 descriptor · 409 attachment_scan_pendingPOST /v1/deposit-requests { attachment_id }
Reserve, PUT, finalize, attach. The API never receives the bytes.
SDK
const pdf = await payday.attachments.upload(bytes, "INV-1042.pdf"); // reserve + PUT + finalize
await payday.depositRequests.create({ ...fields, attachment_id: pdf.id }, "INV-1042");

Lifecycle#

  • Unattached uploads are deleted after seven days.
  • An expired or rejected id on create: 409 attachment_not_ready.
  • One request per attachment: 409 attachment_already_attached.
  • Once attached: readable by the merchant at GET /v1/deposit-requests/{id}/attachment, by an unlocked payer at the payer route, and hashed into the Proof of Payment.

Routes#