POST

Files.Upload

Upload one safe file to the files server (FTP biz1upload/client/, same as dashboard Admin upload_client_file) and attach it to a customer. The display file name is saved in the database, while the stored server file name is generated by the API.

Permissions

User must be logged in with a valid bearer token.
The user must be from the same company domain as the request Host (call the API on that account subdomain or allowed custom domain). A token from another company returns success=0, error user_not_in_company.
Returned or changed records are limited by the user permissions, team access, folder access, and account settings.

Action

Creates a Files record or sends the requested data after validation.

Push Service

No push is sent because this function only reads data or returns helper information.

Automation

No automation is run for this function.

Special Instructions

Send the bearer token on protected calls with Authorization: Bearer YOUR TOKEN.
On a company subdomain (e.g. https://{user_domain}.bull36.com) the user must match that Host — Login and protected APIs reject another company with success=0, error user_not_in_company. On a main brand host (bull36.com, biz1.co.il, mastrocrm.com, …) the company domain gate is skipped.
Send parameters as POST body fields exactly as documented.

Required Parameters

Name	Type	Sample	Explanation
`customer_id` post	int	`123`	Customer id that will own this uploaded file. The user must have permission to edit this customer.
`file` file	file	`contract.pdf`	Multipart file field. Allowed: common document, image, audio, and video types. Executables, scripts, HTML, SVG, empty files, harmful content, and files over the configured max size are blocked.

Optional Parameters

Name	Type	Sample	What it gives
`file_name` post	string	`Signed contract`	Optional user-facing display name saved in the database. Path separators, control characters, and dangerous filename characters are stripped.
`folder` post	string\|int	`default`	Optional file folder/type. Defaults to default.
`sub_folder` post	string\|int	`12`	Optional sub-folder id. When sent, it is saved instead of folder.

Authentication

Send the bearer token returned by Login in the request header. The user must be from the same company domain as this Host — a token from another company is rejected (user_not_in_company).

Authorization: Bearer YOUR TOKEN

Sample Request

{
    "url": "\/app\/Files.Upload",
    "method": "POST",
    "headers": {
        "Authorization": "Bearer YOUR TOKEN"
    },
    "body": {
        "customer_id": "123",
        "file_name": "Signed contract",
        "folder": "default",
        "file": "contract.pdf"
    },
    "url_user": "https:\/\/{user}.bull36.com\/app\/Files.Upload",
    "url_domain": "https:\/\/{domain}\/app\/Files.Upload"
}

Endpoint

POST /app/Files.Upload
POST https://{user}.bull36.com/app/Files.Upload
POST https://{domain}/app/Files.Upload

Sample Output

{
    "success": 1,
    "message": "File uploaded",
    "document_id": 456,
    "file": {
        "id": 456,
        "customer_id": 123,
        "display_name": "Signed contract",
        "stored_name": "14-123-a1b2c3d41784282338.pdf",
        "file_path": "biz1upload\/client\/14-123-a1b2c3d41784282338.pdf",
        "file_url": "https:\/\/files.biz1.co.il\/biz1upload\/client\/14-123-a1b2c3d41784282338.pdf",
        "size": 10240,
        "mime": "application\/pdf",
        "folder": "default"
    }
}

JavaScript Example

const token = 'YOUR TOKEN';
const body = new FormData();
body.append('customer_id', '123');
body.append('file_name', 'Signed contract');
body.append('folder', 'default');
body.append('file', fileInput.files[0]);

const res = await fetch('/app/Files.Upload', {
  method: 'POST',
  headers: { Authorization: `Bearer ${token}` },
  body
});

const data = await res.json();
console.log(data.file.file_url);

Error Example

{
    "success": 0,
    "error": "blocked_file_type",
    "message": "File type is not allowed: php"
}