Skip to main content
POST
Upload a document
Uploads a file for one of your entities. A compliance document is a PDF that goes into one of the four compliance slots and is queued for data extraction; the Surplus Lines category is covered below. Send it as multipart/form-data with the file in the file part.

A category is a slot, not a folder

An entity holds one errors-and-omissions document, one cyber, one W9, one crime-and-fidelity. Uploading into a slot the entity already fills adds a version to that document and returns the same fileDocumentId — which is what a renewal should do. If your client expects a new id per upload, this is the one thing to change. Read fileDocumentId from the response rather than assuming it is new.

Surplus Lines uploads

The category Surplus Lines is not a slot. It is for a file you will put on a Surplus Lines filing. Every upload creates a new document; data.fileDocumentId is its id. The file is on no filing until you attach it. Files on a Surplus Lines Filing walks through the whole flow: upload, attach, download. To fetch any document back later, use Get a Download URL for a Document.

Limits

PDF only

The one exception is Surplus Lines, which also accepts DOC, DOCX, JPEG and PNG. Anything else is rejected with 400 before the body is buffered.

10 MB maximum

A larger file returns 413.

Visibility

A document uploaded here is visible to you and not to your carriers. The agency application’s “share with all markets” switch is deliberately not exposed: it fans ownership out to every carrier from a single flag, and this API has no way to undo that.

Extraction

Turris reads the policy details out of a compliance PDF after upload. That runs asynchronously, so the fields it populates are not on the response to this request. Poll List Documents or check the compliance status shortly afterwards. Surplus Lines uploads are not extracted. Send an Idempotency-Key header. See Idempotency.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

idempotency-key
string

UUID to ensure idempotent request processing

Example:

"550e8400-e29b-41d4-a716-446655440000"

x-idempotency-key
string

Alternative UUID header for idempotent request processing

Example:

"550e8400-e29b-41d4-a716-446655440000"

Body

multipart/form-data
category
enum<string>
required

Which compliance slot this document fills, or Surplus Lines for a file you will attach to a surplus-lines filing.

Available options:
E&O,
Cyber,
Crime & Fidelity,
W9,
Surplus Lines
Example:

"E&O"

file
file
required

The file to upload, 10 MB maximum. PDF only, except Surplus Lines, which also accepts DOC, DOCX, JPEG and PNG.

downstreamEntityId
string

Which of your entities holds this document. Defaults to your own organization. Compliance is tracked per legal entity, so a branch policy must name the branch.

Example:

"6610b3d2c2e0a51b8c0d1f02"

Response

The document, with its versions

data
object
required
requestId
string
required

Unique request identifier

Example:

"dev-2c5e7cf2-9acf-4c8c-ab2f-b81f39d775a8"

timestamp
string
required

Response timestamp

Example:

"2025-11-12T20:49:03.293Z"