Upload a payout RFI file
Uploads a file in response to an active RFI file requirement for the specified fiat payout.
The fileKey in fileMetadata must match one of the fileKey values from the
fileRequirements array returned by GET /v1/payouts/{id}/rfi.
Encryption — required for BFI-generated RFIs, optional for internally-generated RFIs:
Check whether GET /v1/payouts/{id}/rfi returns a non-null certificate field:
-
certificatepresent (BFI-generated RFI): encrypt the file client-side before upload.- Extract
certificate.jwk— an EC public key in JWK format. - Generate a random AES-128 key and encrypt the file bytes using AES-128-GCM. Retain the IV.
- Wrap the AES-128 key using ECDH-ES + AES-128 Key Wrap (
ECDH-ES+A128KW/A128GCM) against the EC public key from step 1. This produces a Compact JWE string (header.encryptedKey.iv.ciphertext.tag). - Submit with all three multipart fields (
fileMetadata,encryption,encryptedFile).
- Extract
-
certificateabsent (internally-generated RFI): omitencryptionandencryptedFile. Submit onlyfileMetadataand the rawfilefield. The file is stored with standard encryption-at-rest; no client-side encryption step is needed.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
Universally unique identifier (UUID v4) of a resource.
"b3d9d2d5-4c12-4946-a09d-953e82fae2b0"
Body
JWE encryption envelope. Required when certificate is present in the RFI response
(BFI-generated RFI). Omit for internally-generated RFIs.
AES-128-GCM encrypted file contents. Required when encryption is present
(BFI-generated RFI). Omit for internally-generated RFIs.
Raw (unencrypted) file contents. Required for internally-generated RFIs
(when certificate is absent in the RFI response). Omit for BFI-generated RFIs.
Response
File uploaded successfully.