marketplace
POST /v1/marketplace/vendor/verification/documents
Reserve a document slot and get a short-lived upload URL.
Authentication
Send an API key as a bearer token. This endpoint checks no specific permission, so any key for your organisation can call it.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/marketplace/vendor/verification/documents \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ "kind": <MarketplaceDocumentKind>, "filename": <string>, "content_type": <string<image/jpeg, image/png, application/pdf>>, "size_bytes": <integer> }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
docs/82 §7a. The bytes never pass through the engine. The response carries a presigned PUT the browser uploads straight to object storage with; a 10 MB scan routed through an API worker is 10 MB of a request thread and a request that outlives its timeout on a poor connection. ⛔ The stored object key is deliberately absent from the response — the seller needs the signed URL, never the address of an object in a bucket of identity documents. ⛔ We ask for "a government-issued photo ID" — passport, national identity card, driving licence or residence permit — and there is no country list. A student, workplace or library card is not government-issued and is not accepted.
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
kind | MarketplaceDocumentKind | Yes | What a stored object is evidence of. photo_id covers passport, national identity card, driving licence and residence permit — there is no country list, and a student, workplace… |
subject_id | string | No | Required for photo_id and proof_of_address — a personal document with no person satisfies nobody's requirement while looking uploaded on every screen. |
filename | string | Yes | — |
content_type | string<image/jpeg, image/png, application/pdf> | Yes | JPEG, PNG or PDF. An allow-list, not a deny-list. |
size_bytes | integer | Yes | — |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
document | MarketplaceVerificationDocument | Yes | A pointer to one uploaded document. The bytes live in object storage and are reached only through a short-lived signed URL; the object key is never published. |
upload | MarketplaceDocumentUploadGrant | Yes | A presigned upload. The headers are part of the grant, not decoration — a signature computed over content-type fails with a 403 if the uploader omits it. |
Errors this endpoint can return
401 · 404 · 422