Files & uploads

Uploads

Uploads use multipart/form-data with one file part. When the operation also needs options, they go in a data part as a JSON string (not a nested form).

Endpoint	Parts	File	Limit
POST /v1/signature-requests	file + data	PDF	15 MB
POST /v1/registered-mails/{id}/attachments	file	PDF	Count and total size set by the entity (attachmentsMaxCount, attachmentsMaxSizeMb in the options)
POST /v1/contacts/import	file + data	CSV (UTF-8, header row)	5 MB, 5,000 rows

• PDFs are checked by content (they must start with %PDF-), not by extension: otherwise 422 invalid_pdf.
• A missing file answers 422 file_required (import_file_required for CSV imports).
• A file above the transport limit of the endpoint is rejected before processing with 413 (code http_error).
• File names may contain any UTF-8 character; they are kept for display and download.

curl

curl -s -X POST "$MLT_API_URL/v1/registered-mails/$MAIL_ID/attachments" \
  -H "Authorization: Bearer $MLT_TOKEN" \
  -F 'file=@mise-en-demeure.pdf;type=application/pdf'

Node.js

import { openAsBlob } from 'node:fs';

const form = new FormData();
form.append('file', await openAsBlob('mise-en-demeure.pdf', { type: 'application/pdf' }), 'mise-en-demeure.pdf');
const mail = await fetch(`${process.env.MLT_API_URL}/v1/registered-mails/${mailId}/attachments`, {
  method: 'POST',
  headers: { Authorization: `Bearer ${token}` }, // do not set Content-Type: fetch adds the multipart boundary
  body: form,
}).then((r) => r.json());

Python

with open("mise-en-demeure.pdf", "rb") as pdf:
    mail = requests.post(
        f"{api}/v1/registered-mails/{mail_id}/attachments",
        headers=headers,
        files={"file": ("mise-en-demeure.pdf", pdf, "application/pdf")},
    ).json()

PHP

$mail = json_decode((string) $http->post("$api/v1/registered-mails/$mailId/attachments", [
    'headers' => $headers,
    'multipart' => [
        ['name' => 'file', 'contents' => fopen('mise-en-demeure.pdf', 'r'), 'filename' => 'mise-en-demeure.pdf', 'headers' => ['Content-Type' => 'application/pdf']],
    ],
])->getBody(), true);

Downloads

Endpoint	Returns
GET /v1/signature-requests/{id}/document?variant=original|signed	The original PDF, or the signed PDF once the request is completed.
GET /v1/registered-mails/{id}/attachments/{attachmentId}	An attachment.
GET /v1/registered-mails/{id}/items/{itemId}/proofs/{kind}	A legal proof: deposit, delivery, refusal, negligence or content.
GET /v1/contacts/export	The contacts matching the filters, as CSV.

Downloads answer with the file itself and a Content-Disposition: attachment header carrying the file name (ASCII fallback plus UTF-8 filename*).

Integrity

Registered mail attachments and proofs are fingerprinted with SHA-256 when stored (attachments[].sha256, items[].proofs[].sha256). Compare the hash of a downloaded proof with the listed value to check it was not altered.

shasum -a 256 proof-delivery.pdf

Retention

Signed documents follow the retention policy of the entity (retention on each signature request): after the retention period, files are archived or deleted while the metadata and the proof of signature are kept. Downloading a purged document answers 409 document_purged or 409 document_archived.