Upload the document set through a hosted link
The hosted page’s upload: the link URL itself is the credential - a time-limited, single-purpose capability, no API key. Send the COMPLETE document set in one request: multipart/form-data with one part per page (a two-sided ID is two parts), or the raw bytes of a single file with its Content-Type. The request itself is completeness - there is no add-another-page call.
Validation: PDF, JPEG and PNG only, at most 10 MB per file, at most 2 files, and the bytes must actually be the format the Content-Type declares (file signatures are checked) - a mislabeled file is refused with invalid_request.
Path Parameters
The hosted token from a document link.
^rql_[0-9a-f]{48}$Query Parameters
The filename, when the body is raw bytes rather than multipart.
256Body
Response
The context afterwards - resolved when the set completes the ask.
What a hosted page shows, read through the link's own token - names only, no identifiers, since the holder is your client rather than you.
Entity name.
requirement_context document, form, name_change, information, signature open, resolved, canceled The partner name a hosted page brands itself with, resolved from the link token.
The partner's hosted-page configuration - brand and legal footer.
The form the order's current fulfilment step is waiting on.
The one origin allowed to frame this page, when the session was minted for embedding. The hosted page treats this as the authority and refuses to run framed anywhere else. Absent on ordinary sessions.