Upload

Upload signed guest management documents for a visit

Stores one or more completed, signed PDFs against the visit named by 'inviteUuid' and records them on that visit. This is the in-house counterpart to the signing provider's completion webhook: the caller already holds the finished document and hands us the bytes. The visit is required - a signed document with nothing to attach it to is unreachable afterwards. Send one 'inviteUuid' part and a repeated 'file' part per document, optionally with a matching repeated 'name' part to label each one.

POST/api/upload/guestManagement/signedDocuments

Authorizations

x-auth-apikeystringheaderrequired

Your Rhombus API key. Must be accompanied by the x-auth-scheme header set to api-token (or partner-api-token for partner endpoints).

Authorizationstringheader

Instead of an API key, an OAuth access token: Bearer <token>, with the write scope.

OAuth explains tokens and scopes.

Headers

x-auth-schemeenum<string>headerdefault: api-token

Authentication scheme identifier. Use api-token or partner-api-token with the x-auth-apikey header, api or partner-api with x-auth-apikey plus a client certificate, api-oauth-token or partner-api-oauth-token with x-auth-access-token, and federated-token with x-auth-ft. A request with Authorization: Bearer <token> and no x-auth-scheme is treated as OAuth, and federated-token may also be sent as the x-auth-scheme and x-auth-ft query parameters.

Available options: api-token, api, api-oauth-token, federated-token, partner-api-token, partner-api, partner-api-oauth-token

x-auth-orgstring<RUUID>header

Client organization UUID (22-character RUUID), for partner credentials only. With it the call runs in that client organization with the partner support authority's role. Without it a partner credential runs as the partner organization, which outside the partner endpoints is deprecated (responses carry Deprecation and Sunset: Tue, 05 Jan 2027 00:00:00 GMT). A malformed value returns 400 INVALID_AUTH_ORG; a client organization the partner cannot access returns 403 PARTNER_CLIENT_ACCESS_DENIED.

Length: 22 to 22

Body

multipart/form-data · object

inviteUuidstringbodyrequired

The visit the signed documents belong to.

filestring<binary>bodyrequired

A signed PDF. Repeat the part for each document.

namestringbody

Optional display name for the file in the same position. Repeat it once per file.

bash

curl --request POST \
  --url 'https://api2.rhombussystems.com/api/upload/guestManagement/signedDocuments' \
  --header 'x-auth-scheme: api-token' \
  --header 'x-auth-apikey: YOUR_API_KEY' \
  --form 'inviteUuid=<inviteUuid>' \
  --form 'file=@<path-to-file>' \
  --form 'name=<name>'

import requests

url = "https://api2.rhombussystems.com/api/upload/guestManagement/signedDocuments"
headers = {
    "x-auth-scheme": "api-token",
    "x-auth-apikey": "YOUR_API_KEY",
}
files = {"file": open("<path-to-file>", "rb")}
data = {"inviteUuid": "<inviteUuid>", "name": "<name>"}

response = requests.post(url, headers=headers, files=files, data=data)
response.raise_for_status()
print(response.text)

const form = new FormData();
form.append('file', file); // a File or Blob
form.append('inviteUuid', "<inviteUuid>");
form.append('name', "<name>");

const response = await fetch('https://api2.rhombussystems.com/api/upload/guestManagement/signedDocuments', {
  method: 'POST',
  headers: {
    'x-auth-scheme': 'api-token',
    'x-auth-apikey': 'YOUR_API_KEY',
  },
  body: form,
});
if (!response.ok) throw new Error(`${response.status}: ${await response.text()}`);

console.log(await response.text());

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        // This endpoint takes multipart/form-data (inviteUuid, file, name): build that body with your HTTP client.
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api2.rhombussystems.com/api/upload/guestManagement/signedDocuments"))
            .header("x-auth-scheme", "api-token")
            .header("x-auth-apikey", "YOUR_API_KEY")
            .method("POST", HttpRequest.BodyPublishers.noBody())
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

(not described in the specification)

Response

201 Created

application/json · not described in the specification

Errors

Like every operation, this one can also answer with the standard error body (errorCode, errorMsg). Errors explains each status and how to retry.

400 Bad Request. errorCode is one of: BAD_REQUEST, VALIDATION_FAILED, MISSING_REQUIRED_FIELD, INVALID_JSON, INVALID_REQUEST_BODY, FEATURE_NOT_ENABLED, INVALID_AUTH_ORG, LOCATION_NOT_FOUND.
401 Unauthorized. errorCode is one of: UNAUTHENTICATED, INVALID_CREDENTIAL, CREDENTIAL_EXPIRED, CREDENTIAL_REVOKED, CERTIFICATE_MISMATCH.
403 Forbidden. errorCode is one of: FORBIDDEN, DOMAIN_NOT_ALLOWED, DEVICE_SCOPE_MISMATCH, ROLE_NOT_PERMITTED, FUNCTIONALITY_REQUIRED, PARTNER_FUNCTIONALITY_REQUIRED, PERMISSION_REQUIRED, PARTNER_CLIENT_ACCESS_DENIED, HARDWARE_NOT_AVAILABLE, HARDWARE_ALREADY_REGISTERED, PARTNER_PORTAL_NOT_ENABLED, MANAGED_BY_MSP, SUPER_ADMIN_RESTRICTED_BY_MSP, MSP_DESIGNATION_INVALID, NOT_MANAGED_CLIENT.
429 Too Many Requests. errorCode is one of: RATE_LIMITED.
500 Internal Server Error. errorCode is one of: INTERNAL_ERROR.
503 Service Unavailable. errorCode is one of: SERVICE_UNAVAILABLE.