> ## Documentation Index > Fetch the complete documentation index at: https://api-docs.useopenwrench.com/llms.txt > Use this file to discover all available pages before exploring further. # Upload a file > Uploads one file (multipart field name "file", max 512 MB) to private storage and returns its FileDetails (type marker "FileManager"). Use the returned id with the download endpoint or in attachment fields. ## OpenAPI ````yaml /openapi/buyer.json post /v1/buyer/file/upload openapi: 3.1.0 info: title: OpenWrench Buyer API version: 1.0.0 description: >- External REST API for OpenWrench buyers (facilities-management side). Generated from the application source (Play routes, controllers and models). ## Authentication Every request must carry a buyer API key in the `X-API-KEY` header. The key resolves to a buyer contact, and all reads/writes are tenant-scoped to that contact's buyer company (plus, on several endpoints, role-based location/brand restrictions). Endpoints under `/v1/buyer/super_admin/...` (and a few others noted per-operation) additionally require the key's contact to be a buyer super admin. ## Rate limiting 10 requests per 20-second window per API key; requests beyond that receive **429**. A handful of operations noted per-operation bypass the rate limiter. ## Response envelope Single-entity responses: `{ "type": "", "data": { ... }, "status": "ok" }`. List responses: `{ "type": "", "data": [ ... ], "count": , "status": "ok" }`. count_by responses: `{ "type": "CountBy", "data": , "status": "ok" }`. Errors: `{ "message": "...", "type": "", "status": "error", "traceId": "..." }` — 401 missing/invalid key, 400 bad input, 404 not found, 429 rate limit. ## Pagination & filtering List endpoints accept `offset`, `limit` (default 10, max 25 — the locations list clamps to 10), `sort_by` and `order` (asc|desc). Every other query parameter is treated as a filter and matched against the entity's indexed columns (multi-value filters are comma-separated strings); these are combined with the tenant-security filters derived from the API key. Timestamps are ISO 8601 strings unless noted otherwise. ## Date formats Date-time fields serialize as strings in one of two shapes depending on the underlying type: ISO 8601 with offset (e.g. `2026-08-14T13:05:22.000-07:00`) for most timestamps, or `yyyy-MM-dd HH:mm:ss.S` (space-separated, no offset) for database timestamp fields. Plain dates are `yyyy-MM-dd`. When sending date-times, ISO 8601 is accepted. ## Required headers Every request must carry BOTH `X-API-KEY` (your API key) and `OW-KEY` (the OpenWrench shared secret issued with it). Requests missing either return 401. servers: - url: https://api.useopenwrench.com/api/external security: - ApiKeyAuth: [] OwKeyAuth: [] tags: - name: Ping - name: Me - name: Locations - name: Regions - name: Asset Types - name: Asset Meters - name: Assets - name: Asset Labels description: Read the asset label catalog and replace the labels applied to an asset. - name: Asset Models - name: Work Orders - name: Work Order Notes - name: Work Order Labels description: >- Read your work order label catalog and replace the labels applied to a work order. - name: Service Calls - name: Site Survey Walkthroughs - name: Invoices - name: Proposals - name: Files - name: Planned Maintenance - name: Currency Exchange - name: Supplier Network - name: User Provisioning paths: /v1/buyer/file/upload: post: tags: - Files summary: Upload a file description: >- Uploads one file (multipart field name "file", max 512 MB) to private storage and returns its FileDetails (type marker "FileManager"). Use the returned id with the download endpoint or in attachment fields. operationId: uploadFile requestBody: required: true content: multipart/form-data: schema: type: object properties: file: type: string format: binary description: The file to upload. required: - file responses: '200': description: Success. content: application/json: schema: $ref: '#/components/schemas/FileDetailsResponse' '400': description: Missing file part or upload failure. content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Missing or invalid X-API-KEY. content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: Rate limit exceeded (10 requests per 20-second window per key). content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: Storage upload failed. content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: FileDetailsResponse: type: object properties: type: type: string description: Entity type marker, e.g. "FileManager". data: $ref: '#/components/schemas/FileDetails' status: type: string enum: - ok required: - type - data - status Error: type: object properties: message: type: string type: type: string description: >- Exception type, e.g. unauthorizedException, NotFoundException, BadRequestException, ParseException, InvalidInputDataException, ConflictException, UnexpectedException. status: type: string enum: - error traceId: type: string description: >- Trace id (a random 11-char alphanumeric string when no explicit trace applies). required: - message - type - status - traceId description: >- Standard error envelope. 401 = missing/invalid API key, 400 = bad input, 404 = not found, 429 = rate limit exceeded. FileDetails: type: object properties: fileName: type: string description: Original file name (non-ASCII characters stripped on upload). fileId: type: string description: Opaque file identifier used for later download. required: - fileName - fileId description: 'File reference: name plus storage identifier.' securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-API-KEY OwKeyAuth: type: apiKey in: header name: OW-KEY description: >- OpenWrench shared secret. Required on every request alongside X-API-KEY; issued together with your API key. ````