curl --request POST \
--url https://sandbox.api.afriex.com/api/v1/media/url \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"fileName": "passport.png",
"type": "user"
}
'{
"data": {
"url": "https://s3.amazonaws.com/bucket/key?X-Amz-Algorithm=AWS4-HMAC-SHA256&...",
"key": "64f0c2a1e4b0a1b2c3d4e5f6/invoice.pdf",
"expiresIn": 300
}
}Generate Upload URL
Generates a presigned S3 URL that the caller can use to upload a file (e.g. a KYC document) directly to Afriex’s secure storage. The returned URL is time-limited and scoped to the requested operation. The file name is sanitised before it is used: any directory part is dropped, characters outside A-Z a-z 0-9 . _ - become _, and the result is cut to 200 characters. The object is stored as {businessId}/{sanitisedName}, so always use the returned key, not the name you sent, when you reference the file in a later request.
curl --request POST \
--url https://sandbox.api.afriex.com/api/v1/media/url \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"fileName": "passport.png",
"type": "user"
}
'{
"data": {
"url": "https://s3.amazonaws.com/bucket/key?X-Amz-Algorithm=AWS4-HMAC-SHA256&...",
"key": "64f0c2a1e4b0a1b2c3d4e5f6/invoice.pdf",
"expiresIn": 300
}
}Request a URL
POST /api/v1/media/url with the target fileName and a type (user for identity documents, transaction for transaction files). The response contains a presigned url, the stable object key, and expiresIn (seconds the URL remains valid; typically 300).Upload the file
PUT to the url with the file bytes as the body within the expiresIn window. If the window elapses, request a fresh URL.Reference the file
key to any follow-up request (for example, the invoice field on a SWIFT withdraw, or a document field in SME Registration). Downstream endpoints only accept the object key; the presigned url itself is never accepted.Authorizations
Static business API key issued from the dashboard. A business can provision multiple API keys, each scoped to a configurable set of permissions (e.g. read transactions, create deposits, etc). Permissions are chosen per key at creation time in the dashboard and may be revoked by deleting the key. Manage your keys and their permissions under Developer → API keys in the dashboard.
A request whose key does not carry the permission the target
endpoint requires is rejected with 401 Unauthorized, the same
response an unrecognised, malformed, revoked or disabled key
returns. The API does not distinguish the two cases on the wire.
See the Permissions reference for the permission each endpoint requires.
Headers
API version in ISO 8601 format. The only supported version is 2026-05-18, which is also the default when the header is omitted. Any other value is rejected with a 400 Bad Request.
Body
The name of the file to upload. It is sanitised (directory parts removed, characters outside A-Z a-z 0-9 . _ - replaced with _, cut to 200 characters), so the stored name can differ from this value; use the returned key.
1"document.pdf"
The category of the file being uploaded. Use transaction for transaction-related files (e.g. a transactions CSV) and user for user identity documents. Defaults to user when omitted.
transaction, user Response
Presigned URL generated successfully.
Show child attributes
Show child attributes