API REFERENCE · Batches and files
Create a client token for an authorized private batch upload
Complete request parameters, body fields, response formats, examples, and errors for POST /uploads.
Base URL: https://www.sanctionskit.com/api/v1. Documentation examples are saved and require no API key to read.
POST/uploadsCreate a client token for an authorized private batch upload
Authentication: Authorization: Bearer YOUR_API_KEY (required). Use a server-side key for the intended environment and scopes.
Required API key scope: batches:write. Call through @vercel/blob/client with the pathname from POST /uploads/intent, access private and multipart false. Upload NDJSON with one ScreeningRequest per line, up to 10000 rows. The provider-only upload-completed callback is excluded from this consumer reference.
Request parameters
- Path parameters
- None.
- Query parameters
- None.
- Headers
Authorization(required)
Send JSON body fields as application/json, not as query parameters. Field definitions and nested properties follow below.
Request body
Required body. JSON properties belong in the request body, separately from headers and URL parameters.
JSON request body. Send Content-Type: application/json with UTF-8 encoding; fields marked required must be present. Omit optional fields unless needed. Null is accepted only where explicitly shown. Unknown properties are rejected for validated request objects. Duplicate keys and nesting beyond 32 levels are rejected. Maximum body size: 1,048,576 bytes (1 MiB).
application/jsonView UploadTokenRequest schemaRequest body fields
Required means present in the containing object. Optional fields may be omitted; null is allowed only where stated. Array item fields apply to every item.
typeRequired- "blob.generate-client-token"
Fixed client-token request discriminator.
Must equal "blob.generate-client-token".
payloadRequired- object
Provider client-token payload. Use the exact pathname from the authorized upload intent.
payload fields and rules
payloadRequired.pathname - string
Exact pathname from POST /uploads/intent; it is bound to your organization and key environment.
payloadRequired.clientPayload - string or null
Client metadata field used by the upload protocol. Send null when no metadata is needed.
May be null.
payload.clientPayload fields and rules
Allowed alternatives
- string
- null
May be null.
payloadRequired.multipart - false
Must be false: only a single bounded private upload is supported.
Must equal false.
Example request
{
"type": "blob.generate-client-token",
"payload": {
"pathname": "org/example/sandbox/uploads/example.jsonl",
"clientPayload": null,
"multipart": false
}
}Responses
200Successful response. The response is the documented raw JSON or file content, without a data envelope. Check Content-Type before decoding.
Response headers
X-Request-Id- string
Server-generated request correlation identifier.
Format: uuid.
application/jsonView UploadTokenResponse schemaResponse fields
Required means present in the containing object. Optional fields may be omitted; null is allowed only where stated. Array item fields apply to every item.
typeRequired- "blob.generate-client-token"
Must equal "blob.generate-client-token".
clientTokenRequired- string
Short-lived private upload token. Treat it as a secret and pass it only to the authorized upload client; do not log it.
Example response
Synthetic contract example, validated against the response schema. Invented data; no live customer, provider request, payment, message or source activation.
{
"type": "blob.generate-client-token",
"clientToken": "DOCUMENTATION_EXAMPLE_NOT_A_VALID_TOKEN"
}400invalid_request — Correct the request fields, resource identifiers, JSON body or query parameters before retrying. upload_intent_required — Request an upload intent and pass its exact pathname. invalid_upload — Use the documented single-upload protocol; multipart must be false.
Response headers
X-Request-Id- string
Server-generated correlation identifier, also returned in error.requestId.
Format: uuid.
application/jsonView Error schemaResponse fields
Required means present in the containing object. Optional fields may be omitted; null is allowed only where stated. Array item fields apply to every item.
Failure envelope for every documented non-2xx API response. No data property is returned. Switch on error.code; messages may change.
errorRequired- object
error fields and rules
errorRequired.code - string
Machine-readable failure code. See this operation’s status-specific examples for codes and recovery.
errorRequired.message - string
Human-readable explanation. Do not parse this text to control application behavior.
errorRequired.requestId - string
Server correlation ID, also returned in X-Request-Id. Include this ID in support requests.
Format: uuid.
errorOptional.details - object[] or object or string or number or boolean or null
Optional JSON details for client and validation failures. Validation failures return an array of { path, message } issues; other 4xx codes may return a code-specific object. Server failures omit details. Never assume this key is present.
error.details fields and rules
Allowed alternatives
- object[]
Maximum items: 50.
Each array item: object.
errorRequired.details[] .path - string
Dot-separated invalid field path, including array indexes.
Maximum length: 160.
errorRequired.details[] .message - string
Validation problem for this field.
Maximum length: 300.
- object
Additional keys are allowed; their values are not a fixed contract.
- string or number or boolean or null
May be null.
- object[]
errorOptional.detailsTruncated - boolean
True when only the first 50 validation issues are returned. Validation paths and messages are bounded.
Example response
Synthetic error example. Correct the request fields, resource identifiers, JSON body or query parameters before retrying.
{
"error": {
"code": "invalid_request",
"message": "The request is invalid.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}upload intent required
Synthetic error example. Request an upload intent and pass its exact pathname.
{
"error": {
"code": "upload_intent_required",
"message": "Create an upload intent first, then use its exact pathname.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}invalid upload
Synthetic error example. Use the documented single-upload protocol; multipart must be false.
{
"error": {
"code": "invalid_upload",
"message": "Batch uploads use a single bounded upload.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}401authentication_required — Send Authorization: Bearer with a valid API key. An omitted header can produce authentication_required; invalid supplied credentials produce invalid_api_key. invalid_api_key — Use an active key for the intended environment.
Response headers
X-Request-Id- string
Server-generated correlation identifier, also returned in error.requestId.
Format: uuid.
WWW-Authenticate- string
Bearer authentication challenge.
application/jsonView Error schemaResponse fields
Required means present in the containing object. Optional fields may be omitted; null is allowed only where stated. Array item fields apply to every item.
Failure envelope for every documented non-2xx API response. No data property is returned. Switch on error.code; messages may change.
errorRequired- object
error fields and rules
errorRequired.code - string
Machine-readable failure code. See this operation’s status-specific examples for codes and recovery.
errorRequired.message - string
Human-readable explanation. Do not parse this text to control application behavior.
errorRequired.requestId - string
Server correlation ID, also returned in X-Request-Id. Include this ID in support requests.
Format: uuid.
errorOptional.details - object[] or object or string or number or boolean or null
Optional JSON details for client and validation failures. Validation failures return an array of { path, message } issues; other 4xx codes may return a code-specific object. Server failures omit details. Never assume this key is present.
error.details fields and rules
Allowed alternatives
- object[]
Maximum items: 50.
Each array item: object.
errorRequired.details[] .path - string
Dot-separated invalid field path, including array indexes.
Maximum length: 160.
errorRequired.details[] .message - string
Validation problem for this field.
Maximum length: 300.
- object
Additional keys are allowed; their values are not a fixed contract.
- string or number or boolean or null
May be null.
- object[]
errorOptional.detailsTruncated - boolean
True when only the first 50 validation issues are returned. Validation paths and messages are bounded.
Example response
Synthetic error example. Send Authorization: Bearer with a valid API key. An omitted header can produce authentication_required; invalid supplied credentials produce invalid_api_key.
{
"error": {
"code": "authentication_required",
"message": "Sign in to continue.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}invalid api key
Synthetic error example. Use an active key for the intended environment.
{
"error": {
"code": "invalid_api_key",
"message": "The API key is invalid, expired, or revoked.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}403permission_denied — Ask an organization owner to grant the required role or API-key scope. insufficient_scope — Use a key with the scope stated in this operation.
Response headers
X-Request-Id- string
Server-generated correlation identifier, also returned in error.requestId.
Format: uuid.
application/jsonView Error schemaResponse fields
Required means present in the containing object. Optional fields may be omitted; null is allowed only where stated. Array item fields apply to every item.
Failure envelope for every documented non-2xx API response. No data property is returned. Switch on error.code; messages may change.
errorRequired- object
error fields and rules
errorRequired.code - string
Machine-readable failure code. See this operation’s status-specific examples for codes and recovery.
errorRequired.message - string
Human-readable explanation. Do not parse this text to control application behavior.
errorRequired.requestId - string
Server correlation ID, also returned in X-Request-Id. Include this ID in support requests.
Format: uuid.
errorOptional.details - object[] or object or string or number or boolean or null
Optional JSON details for client and validation failures. Validation failures return an array of { path, message } issues; other 4xx codes may return a code-specific object. Server failures omit details. Never assume this key is present.
error.details fields and rules
Allowed alternatives
- object[]
Maximum items: 50.
Each array item: object.
errorRequired.details[] .path - string
Dot-separated invalid field path, including array indexes.
Maximum length: 160.
errorRequired.details[] .message - string
Validation problem for this field.
Maximum length: 300.
- object
Additional keys are allowed; their values are not a fixed contract.
- string or number or boolean or null
May be null.
- object[]
errorOptional.detailsTruncated - boolean
True when only the first 50 validation issues are returned. Validation paths and messages are bounded.
Example response
Synthetic error example. Ask an organization owner to grant the required role or API-key scope.
{
"error": {
"code": "permission_denied",
"message": "Your role does not allow this action.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}insufficient scope
Synthetic error example. Use a key with the scope stated in this operation.
{
"error": {
"code": "insufficient_scope",
"message": "The API key does not grant this action.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}405method_not_allowed — Use a method in the Allow response header. OPTIONS lists supported methods; HEAD follows GET authorization and returns no body.
Response headers
X-Request-Id- string
Server-generated correlation identifier, also returned in error.requestId.
Format: uuid.
Allow- string
Comma-separated supported HTTP methods.
application/jsonView Error schemaResponse fields
Required means present in the containing object. Optional fields may be omitted; null is allowed only where stated. Array item fields apply to every item.
Failure envelope for every documented non-2xx API response. No data property is returned. Switch on error.code; messages may change.
errorRequired- object
error fields and rules
errorRequired.code - string
Machine-readable failure code. See this operation’s status-specific examples for codes and recovery.
errorRequired.message - string
Human-readable explanation. Do not parse this text to control application behavior.
errorRequired.requestId - string
Server correlation ID, also returned in X-Request-Id. Include this ID in support requests.
Format: uuid.
errorOptional.details - object[] or object or string or number or boolean or null
Optional JSON details for client and validation failures. Validation failures return an array of { path, message } issues; other 4xx codes may return a code-specific object. Server failures omit details. Never assume this key is present.
error.details fields and rules
Allowed alternatives
- object[]
Maximum items: 50.
Each array item: object.
errorRequired.details[] .path - string
Dot-separated invalid field path, including array indexes.
Maximum length: 160.
errorRequired.details[] .message - string
Validation problem for this field.
Maximum length: 300.
- object
Additional keys are allowed; their values are not a fixed contract.
- string or number or boolean or null
May be null.
- object[]
errorOptional.detailsTruncated - boolean
True when only the first 50 validation issues are returned. Validation paths and messages are bounded.
Example response
Synthetic error example. Use a method in the Allow response header. OPTIONS lists supported methods; HEAD follows GET authorization and returns no body.
{
"error": {
"code": "method_not_allowed",
"message": "This method is not supported for this endpoint.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}408invalid_request — Reconnect and retry using the same idempotency key and identical input where supported.
Response headers
X-Request-Id- string
Server-generated correlation identifier, also returned in error.requestId.
Format: uuid.
application/jsonView Error schemaResponse fields
Required means present in the containing object. Optional fields may be omitted; null is allowed only where stated. Array item fields apply to every item.
Failure envelope for every documented non-2xx API response. No data property is returned. Switch on error.code; messages may change.
errorRequired- object
error fields and rules
errorRequired.code - string
Machine-readable failure code. See this operation’s status-specific examples for codes and recovery.
errorRequired.message - string
Human-readable explanation. Do not parse this text to control application behavior.
errorRequired.requestId - string
Server correlation ID, also returned in X-Request-Id. Include this ID in support requests.
Format: uuid.
errorOptional.details - object[] or object or string or number or boolean or null
Optional JSON details for client and validation failures. Validation failures return an array of { path, message } issues; other 4xx codes may return a code-specific object. Server failures omit details. Never assume this key is present.
error.details fields and rules
Allowed alternatives
- object[]
Maximum items: 50.
Each array item: object.
errorRequired.details[] .path - string
Dot-separated invalid field path, including array indexes.
Maximum length: 160.
errorRequired.details[] .message - string
Validation problem for this field.
Maximum length: 300.
- object
Additional keys are allowed; their values are not a fixed contract.
- string or number or boolean or null
May be null.
- object[]
errorOptional.detailsTruncated - boolean
True when only the first 50 validation issues are returned. Validation paths and messages are bounded.
Example response
Synthetic error example. Reconnect and retry using the same idempotency key and identical input where supported.
{
"error": {
"code": "invalid_request",
"message": "The request body was not received within 10 seconds.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}409upload_token_expired — Create a fresh upload intent.
Response headers
X-Request-Id- string
Server-generated correlation identifier, also returned in error.requestId.
Format: uuid.
application/jsonView Error schemaResponse fields
Required means present in the containing object. Optional fields may be omitted; null is allowed only where stated. Array item fields apply to every item.
Failure envelope for every documented non-2xx API response. No data property is returned. Switch on error.code; messages may change.
errorRequired- object
error fields and rules
errorRequired.code - string
Machine-readable failure code. See this operation’s status-specific examples for codes and recovery.
errorRequired.message - string
Human-readable explanation. Do not parse this text to control application behavior.
errorRequired.requestId - string
Server correlation ID, also returned in X-Request-Id. Include this ID in support requests.
Format: uuid.
errorOptional.details - object[] or object or string or number or boolean or null
Optional JSON details for client and validation failures. Validation failures return an array of { path, message } issues; other 4xx codes may return a code-specific object. Server failures omit details. Never assume this key is present.
error.details fields and rules
Allowed alternatives
- object[]
Maximum items: 50.
Each array item: object.
errorRequired.details[] .path - string
Dot-separated invalid field path, including array indexes.
Maximum length: 160.
errorRequired.details[] .message - string
Validation problem for this field.
Maximum length: 300.
- object
Additional keys are allowed; their values are not a fixed contract.
- string or number or boolean or null
May be null.
- object[]
errorOptional.detailsTruncated - boolean
True when only the first 50 validation issues are returned. Validation paths and messages are bounded.
Example response
Synthetic error example. Create a fresh upload intent.
{
"error": {
"code": "upload_token_expired",
"message": "This upload token has expired. Create a new upload intent.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}413response_too_large — Reduce the requested page size or use the documented segmented case archive. No evidence is silently truncated.
Response headers
X-Request-Id- string
Server-generated correlation identifier, also returned in error.requestId.
Format: uuid.
application/jsonView Error schemaResponse fields
Required means present in the containing object. Optional fields may be omitted; null is allowed only where stated. Array item fields apply to every item.
Failure envelope for every documented non-2xx API response. No data property is returned. Switch on error.code; messages may change.
errorRequired- object
error fields and rules
errorRequired.code - string
Machine-readable failure code. See this operation’s status-specific examples for codes and recovery.
errorRequired.message - string
Human-readable explanation. Do not parse this text to control application behavior.
errorRequired.requestId - string
Server correlation ID, also returned in X-Request-Id. Include this ID in support requests.
Format: uuid.
errorOptional.details - object[] or object or string or number or boolean or null
Optional JSON details for client and validation failures. Validation failures return an array of { path, message } issues; other 4xx codes may return a code-specific object. Server failures omit details. Never assume this key is present.
error.details fields and rules
Allowed alternatives
- object[]
Maximum items: 50.
Each array item: object.
errorRequired.details[] .path - string
Dot-separated invalid field path, including array indexes.
Maximum length: 160.
errorRequired.details[] .message - string
Validation problem for this field.
Maximum length: 300.
- object
Additional keys are allowed; their values are not a fixed contract.
- string or number or boolean or null
May be null.
- object[]
errorOptional.detailsTruncated - boolean
True when only the first 50 validation issues are returned. Validation paths and messages are bounded.
Example response
Synthetic error example. Reduce the requested page size or use the documented segmented case archive. No evidence is silently truncated.
{
"error": {
"code": "response_too_large",
"message": "This response exceeds the size limit. Request a smaller page or a segmented export.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}415invalid_request — Use Content-Type: application/json and an uncompressed UTF-8 body.
Response headers
X-Request-Id- string
Server-generated correlation identifier, also returned in error.requestId.
Format: uuid.
application/jsonView Error schemaResponse fields
Required means present in the containing object. Optional fields may be omitted; null is allowed only where stated. Array item fields apply to every item.
Failure envelope for every documented non-2xx API response. No data property is returned. Switch on error.code; messages may change.
errorRequired- object
error fields and rules
errorRequired.code - string
Machine-readable failure code. See this operation’s status-specific examples for codes and recovery.
errorRequired.message - string
Human-readable explanation. Do not parse this text to control application behavior.
errorRequired.requestId - string
Server correlation ID, also returned in X-Request-Id. Include this ID in support requests.
Format: uuid.
errorOptional.details - object[] or object or string or number or boolean or null
Optional JSON details for client and validation failures. Validation failures return an array of { path, message } issues; other 4xx codes may return a code-specific object. Server failures omit details. Never assume this key is present.
error.details fields and rules
Allowed alternatives
- object[]
Maximum items: 50.
Each array item: object.
errorRequired.details[] .path - string
Dot-separated invalid field path, including array indexes.
Maximum length: 160.
errorRequired.details[] .message - string
Validation problem for this field.
Maximum length: 300.
- object
Additional keys are allowed; their values are not a fixed contract.
- string or number or boolean or null
May be null.
- object[]
errorOptional.detailsTruncated - boolean
True when only the first 50 validation issues are returned. Validation paths and messages are bounded.
Example response
Synthetic error example. Use Content-Type: application/json and an uncompressed UTF-8 body.
{
"error": {
"code": "invalid_request",
"message": "Send application/json with UTF-8 encoding.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}429rate_limited — Wait for the request window to reset and retry with backoff.
Response headers
X-Request-Id- string
Server-generated correlation identifier, also returned in error.requestId.
Format: uuid.
Retry-After- string
When present, a delay in seconds or an HTTP-date before which the client should not retry. Service-unavailable responses default to a one-second delay unless another safe value is supplied. A usage allowance error may require quota recovery instead of retrying.
application/jsonView Error schemaResponse fields
Required means present in the containing object. Optional fields may be omitted; null is allowed only where stated. Array item fields apply to every item.
Failure envelope for every documented non-2xx API response. No data property is returned. Switch on error.code; messages may change.
errorRequired- object
error fields and rules
errorRequired.code - string
Machine-readable failure code. See this operation’s status-specific examples for codes and recovery.
errorRequired.message - string
Human-readable explanation. Do not parse this text to control application behavior.
errorRequired.requestId - string
Server correlation ID, also returned in X-Request-Id. Include this ID in support requests.
Format: uuid.
errorOptional.details - object[] or object or string or number or boolean or null
Optional JSON details for client and validation failures. Validation failures return an array of { path, message } issues; other 4xx codes may return a code-specific object. Server failures omit details. Never assume this key is present.
error.details fields and rules
Allowed alternatives
- object[]
Maximum items: 50.
Each array item: object.
errorRequired.details[] .path - string
Dot-separated invalid field path, including array indexes.
Maximum length: 160.
errorRequired.details[] .message - string
Validation problem for this field.
Maximum length: 300.
- object
Additional keys are allowed; their values are not a fixed contract.
- string or number or boolean or null
May be null.
- object[]
errorOptional.detailsTruncated - boolean
True when only the first 50 validation issues are returned. Validation paths and messages are bounded.
Example response
Synthetic error example. Wait for the request window to reset and retry with backoff.
{
"error": {
"code": "rate_limited",
"message": "The per-minute request limit has been reached.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}500internal_error — Retry with backoff. For writes reuse the same idempotency key and identical input; include requestId when contacting support.
Response headers
X-Request-Id- string
Server-generated correlation identifier, also returned in error.requestId.
Format: uuid.
application/jsonView Error schemaResponse fields
Required means present in the containing object. Optional fields may be omitted; null is allowed only where stated. Array item fields apply to every item.
Failure envelope for every documented non-2xx API response. No data property is returned. Switch on error.code; messages may change.
errorRequired- object
error fields and rules
errorRequired.code - string
Machine-readable failure code. See this operation’s status-specific examples for codes and recovery.
errorRequired.message - string
Human-readable explanation. Do not parse this text to control application behavior.
errorRequired.requestId - string
Server correlation ID, also returned in X-Request-Id. Include this ID in support requests.
Format: uuid.
errorOptional.details - object[] or object or string or number or boolean or null
Optional JSON details for client and validation failures. Validation failures return an array of { path, message } issues; other 4xx codes may return a code-specific object. Server failures omit details. Never assume this key is present.
error.details fields and rules
Allowed alternatives
- object[]
Maximum items: 50.
Each array item: object.
errorRequired.details[] .path - string
Dot-separated invalid field path, including array indexes.
Maximum length: 160.
errorRequired.details[] .message - string
Validation problem for this field.
Maximum length: 300.
- object
Additional keys are allowed; their values are not a fixed contract.
- string or number or boolean or null
May be null.
- object[]
errorOptional.detailsTruncated - boolean
True when only the first 50 validation issues are returned. Validation paths and messages are bounded.
Example response
Synthetic error example. Retry with backoff. For writes reuse the same idempotency key and identical input; include requestId when contacting support.
{
"error": {
"code": "internal_error",
"message": "The request could not be completed.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}503temporarily_unavailable — Honor Retry-After when present and retry with bounded backoff. Follow this endpoint’s retry contract; preserve the same key and input for idempotent writes. Contact support with requestId if the failure persists.
Response headers
X-Request-Id- string
Server-generated correlation identifier, also returned in error.requestId.
Format: uuid.
Retry-After- string
When present, a delay in seconds or an HTTP-date before which the client should not retry. Service-unavailable responses default to a one-second delay unless another safe value is supplied. A usage allowance error may require quota recovery instead of retrying.
application/jsonView Error schemaResponse fields
Required means present in the containing object. Optional fields may be omitted; null is allowed only where stated. Array item fields apply to every item.
Failure envelope for every documented non-2xx API response. No data property is returned. Switch on error.code; messages may change.
errorRequired- object
error fields and rules
errorRequired.code - string
Machine-readable failure code. See this operation’s status-specific examples for codes and recovery.
errorRequired.message - string
Human-readable explanation. Do not parse this text to control application behavior.
errorRequired.requestId - string
Server correlation ID, also returned in X-Request-Id. Include this ID in support requests.
Format: uuid.
errorOptional.details - object[] or object or string or number or boolean or null
Optional JSON details for client and validation failures. Validation failures return an array of { path, message } issues; other 4xx codes may return a code-specific object. Server failures omit details. Never assume this key is present.
error.details fields and rules
Allowed alternatives
- object[]
Maximum items: 50.
Each array item: object.
errorRequired.details[] .path - string
Dot-separated invalid field path, including array indexes.
Maximum length: 160.
errorRequired.details[] .message - string
Validation problem for this field.
Maximum length: 300.
- object
Additional keys are allowed; their values are not a fixed contract.
- string or number or boolean or null
May be null.
- object[]
errorOptional.detailsTruncated - boolean
True when only the first 50 validation issues are returned. Validation paths and messages are bounded.
Example response
Synthetic error example. Honor Retry-After when present and retry with bounded backoff. Follow this endpoint’s retry contract; preserve the same key and input for idempotent writes. Contact support with requestId if the failure persists.
{
"error": {
"code": "temporarily_unavailable",
"message": "The service is temporarily unavailable. Retry shortly.",
"requestId": "01234567-89ab-4cde-8f01-23456789abcd"
}
}