Skip to main content
Files in Credentials Portal are attached to individual people. They are stored securely and served through authenticated proxy routes.

​
List all district files

GET /api/files
Returns metadata for all files uploaded in your district. Example: 
curl https://app.credentialsportal.com/api/files \
  -H "Authorization: Bearer ck_your_api_key"
Response: 
[
  {
    "id": "upl01",
    "district_id": "xyz99",
    "person_id": "abc12",
    "name": "Background Check",
    "filename": "background-check.pdf",
    "content_type": "application/pdf",
    "size": 204800,
    "url": "https://app.credentialsportal.com/files/xyz99/upload/abc12/background-check.pdf",
    "created_at": 1739577600000
  }
]

​
Upload a file

POST /api/upload
Uploads a file to the district’s storage and associates it with a person. Form data:
FieldDescription
fileThe file to upload (multipart)
personIdThe person to associate the file with
nameDisplay name for the file (optional)
Example: 
curl -X POST https://app.credentialsportal.com/api/upload \
  -H "Authorization: Bearer ck_your_api_key" \
  -F "file=@/path/to/document.pdf" \
  -F "personId=abc12" \
  -F "name=Background Check"
Response: 
{
  "id": "upl02",
  "person_id": "abc12",
  "name": "Background Check",
  "filename": "document.pdf",
  "content_type": "application/pdf",
  "size": 204800,
  "url": "https://app.credentialsportal.com/files/xyz99/upload/abc12/document.pdf",
  "created_at": 1741564800000
}

​
Upload a file for a specific person

POST /api/people/:id/uploads
Equivalent to the upload endpoint above, scoped to a specific person.

​
Update file metadata

PATCH /api/files/:uploadId
Update a file’s name or reassign it to a different person. Request body:
​
name
string
New display name for the file.
​
person_id
string
Reassign the file to a different person.

​
Delete a file

DELETE /api/people/:personId/uploads/:uploadId
Permanently deletes the file from storage. Example: 
curl -X DELETE https://app.credentialsportal.com/api/people/abc12/uploads/upl02 \
  -H "Authorization: Bearer ck_your_api_key"
Response: 
{ "ok": true }

​
Access file content

Files are served via an authenticated proxy route: 
GET /files/:districtId/:type/:personId/:filename
The url field returned in file responses points to this route. Include your session token or API key to access protected files.
File URLs are not publicly accessible. All requests to file URLs must include a valid Authorization header.