> ## Documentation Index
> Fetch the complete documentation index at: https://dev.enterprise.moonpay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Upload an RFI document



## OpenAPI

````yaml https://api.sandbox.iron.xyz/spec/2026-10-15/docs post /rfis/{rfi_id}/rounds/{round_id}/documents
openapi: 3.2.0
info:
  description: The Stablecoin Payment Network
  title: Iron API - Sandbox
  version: '2026-10-15'
servers:
  - url: https://api.sandbox.iron.xyz/api
security: []
tags:
  - description: Operations on Customers
    kind: nav
    name: Customer
  - description: Verifying a customer's identity or business
    kind: nav
    name: Identifications
    parent: Customer
  - description: The legal agreements and consents a customer signs
    kind: nav
    name: Signings
    parent: Customer
  - description: Compliance requests for documents or answers from a customer
    kind: nav
    name: Requests for information
    parent: Customer
  - description: Codes that authorize an autoramp or bank account awaiting authorization
    kind: nav
    name: Authentication codes
    parent: Customer
  - description: >-
      Wallet and bank account registration


      Every wallet address that interacts with Iron must be registered (linked)
      to a customer **before** it can be used in any flow — onramp, offramp, or
      swap. This is a regulatory requirement under the **Travel Rule**, which
      obliges Virtual Asset Service Providers to exchange originator and
      beneficiary information for crypto transfers.


      Iron supports two wallet types:


      - **Self-hosted wallets** — the customer controls the private key.
      Registration requires a signed proof-of-ownership message.

      - **Hosted wallets** — the wallet is custodied by another VASP (e.g.
      Coinbase, Kraken). Registration requires the VASP's DID so Iron can
      exchange travel-rule data with the custodian.


      Similarly, fiat bank accounts must be registered before they can receive
      offramp payouts.
    kind: nav
    name: Addresses
  - description: Bank accounts that receive offramp payouts
    kind: nav
    name: Bank accounts
    parent: Addresses
  - description: Self-hosted and hosted wallets
    kind: nav
    name: Wallets
    parent: Addresses
  - description: Pix keys that receive BRL payouts
    kind: nav
    name: Pix
    parent: Addresses
  - description: Operations on Autoramp
    kind: nav
    name: Autoramp
  - description: Prices for an autoramp's conversion
    kind: nav
    name: Quotes
    parent: Autoramp
  - description: Paying into an autoramp by open banking or Pix
    kind: nav
    name: Payments
    parent: Autoramp
  - description: The transactions autoramps execute
    kind: nav
    name: Transactions
    parent: Autoramp
  - description: Operations on Currencies
    kind: nav
    name: Currencies
  - description: Operations on Exchange Rate
    kind: nav
    name: ExchangeRate
  - description: Operations on Fee Profiles
    kind: nav
    name: FeeProfiles
  - description: Operations on Webhooks
    kind: nav
    name: Webhooks
  - description: Operations on Terms and Conditions
    kind: nav
    name: TermsAndConditions
  - description: Operations for Sandbox Testing
    kind: nav
    name: Sandbox
paths:
  /rfis/{rfi_id}/rounds/{round_id}/documents:
    post:
      tags:
        - Requests for information
      summary: Upload an RFI document
      operationId: uploadRfiDocument
      parameters:
        - deprecated: false
          explode: true
          in: header
          name: IDEMPOTENCY-KEY
          required: false
          schema:
            type: string
        - deprecated: false
          explode: true
          in: path
          name: rfi_id
          required: true
          schema:
            format: uuid
            type: string
        - deprecated: false
          explode: true
          in: path
          name: round_id
          required: true
          schema:
            format: uuid
            type: string
        - $ref: '#/components/parameters/XApiVersion'
      requestBody:
        content:
          multipart/form-data:
            schema:
              properties:
                file:
                  format: binary
                  type: string
              required:
                - file
              type: object
        required: true
      responses:
        '200':
          content:
            application/json; charset=utf-8:
              schema:
                $ref: '#/components/schemas/RfiDocument'
          description: ''
        '400':
          content:
            application/json; charset=utf-8:
              schema:
                $ref: '#/components/schemas/RfiError'
          description: ''
        '403':
          description: ''
        '404':
          description: ''
        '409':
          description: ''
        '500':
          description: ''
      security:
        - ApiKeyAuth: []
components:
  parameters:
    XApiVersion:
      description: >-
        Selects the API version for this request, as an ISO date (`YYYY-MM-DD`).
        Omit to use the default version (`2025-03-13`). Supported versions:
        2025-03-13, 2026-07-01, 2026-08-01, 2026-10-01, 2026-10-15.
      in: header
      name: X-API-Version
      required: false
      schema:
        type: string
        x-default: '2026-10-15'
  schemas:
    RfiDocument:
      description: A file uploaded for a round. Only the backoffice can download it.
      properties:
        content_type:
          type: string
        file_name:
          type: string
        id:
          format: uuid
          type: string
        size_bytes:
          format: int64
          type: integer
        uploaded_at:
          format: date-time
          type: string
      required:
        - id
        - file_name
        - content_type
        - size_bytes
        - uploaded_at
      title: RfiDocument
      type: object
    RfiError:
      properties:
        code:
          $ref: '#/components/schemas/RfiErrorCode'
        message:
          type: string
      required:
        - code
        - message
      title: RfiError
      type: object
    RfiErrorCode:
      enum:
        - malformed_answers
        - documents_not_uploaded
        - liveness_not_allowed
        - invalid_document
      type: string
  securitySchemes:
    ApiKeyAuth:
      description: API Key
      in: header
      name: X-API-Key
      type: apiKey

````