Endpoint

Upload a file

POST/v1/files

multipart/form-data with parts file and purpose. This is the only endpoint that does not take JSON.

Scope a restricted key needs: files:write
Publishable key: Not allowed: secret or restricted key only
Idempotency-Key: Recommended. It makes a retry safe.

Parameters

Parameters of Upload a file
Parameter	Type and place	Meaning
`Orrerie-Version`	stringheader	API version date. Default: the version the key was created with. Example `2026-10-11`.
`Idempotency-Key`	stringheader	Makes a retry safe. Kept 24 hours. 1 to 255 characters.

Request body

A multipart/form-data form. The body is required. A field the call does not list is refused with parameter_unknown.

Request body of Upload a file
Field	Type	Meaning
`file`required	string (binary)	The file.
`purpose`required	string	`logo` or `product_image`. `invoice_attachment` is not offered in this release and is refused with `parameter_invalid`, reason `not_offered`. One of `logo`, `product_image`, `invoice_attachment`.

Example request

curl

curl https://api.orrerie.com/v1/files \
  -H "Authorization: Bearer $ORRERIE_SECRET_KEY" \
  -F "file=@logo.png" \
  -F "purpose=logo"

JavaScript

import { openAsBlob } from "node:fs";

const form = new FormData();
form.append("file", await openAsBlob("logo.png"), "logo.png");
form.append("purpose", "logo");

const response = await fetch("https://api.orrerie.com/v1/files", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ORRERIE_SECRET_KEY}`,
  },
  body: form,
});
const result = await response.json();
if (!response.ok) throw new Error(`${result.error.code}: ${result.error.message}`);
console.log(result);

Python

import os
import requests

response = requests.post(
    "https://api.orrerie.com/v1/files",
    headers={"Authorization": f"Bearer {os.environ['ORRERIE_SECRET_KEY']}"},
    files={"file": open("logo.png", "rb")},
    data={
        "purpose": "logo",
    },
    timeout=30,
)
result = response.json()
if not response.ok:
    raise RuntimeError(f"{result['error']['code']}: {result['error']['message']}")
print(result)

PHP

<?php
$request = curl_init('https://api.orrerie.com/v1/files');
curl_setopt_array($request, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('ORRERIE_SECRET_KEY'),
    ],
    CURLOPT_POSTFIELDS => [
        'file' => new CURLFile('logo.png'),
        'purpose' => 'logo',
    ],
]);
$body = curl_exec($request);
if ($body === false) {
    throw new RuntimeException(curl_error($request));
}
$result = json_decode($body, true);
if (curl_getinfo($request, CURLINFO_HTTP_CODE) >= 400) {
    throw new RuntimeException($result['error']['code'] . ': ' . $result['error']['message']);
}
print_r($result);

Responses

`201` Created

The answer is the file object. Headers: Orrerie-Request-Id.

Example response, 201

{
  "id": "file_xn5cz8fk5zmyx3kp37rvddgs",
  "object": "file",
  "livemode": true,
  "created": "2026-09-02T09:30:00.000Z",
  "purpose": "logo",
  "filename": "acme-logo.png",
  "mime_type": "image/png",
  "size": 48213,
  "sha256": "a1c7b03ea5a227bc090751384067035d8ecc3365b30c03d8a792eff6db1accf5",
  "expires_at": null
}

Any other status: an error

A status of 400 or above answers with the error object. Branch on its code, never on its message.

Errors

Beside the errors every call can answer with (a bad key, a missing scope, the rate limit), this call answers with:

Errors of Upload a file
Code	HTTP	Meaning
`file_too_large`	413	The upload is over 5 MB.
`file_type_not_allowed`	400	The upload is not PNG, JPEG, WebP or PDF, or its content does not match its type.
`file_limit_reached`	403	The business has 500 stored pictures, the most it may have; see `limit`. Delete one it no longer uses first. A picture is deleted with `DELETE /v1/files/{id}`; uploading the same picture again answers the file already stored.