# Property documents Uploads private documents to a property and lists the documents it already has. Source: https://dev.alterestate.com/properties/documents Last updated: 2026-11-09 Documents are the files in the Private documents (Documentos privados) card of a property in the dashboard: title deeds, contracts, plans, appraisals. Only users of your agency can see them. They never appear on the website or on portals. Photos are a different thing: see Upload property photos. > Send multipart/form-data, one file per request. Do not set Content-Type yourself: the client adds the multipart boundary. Any file type is accepted, up to 100 MB. To upload several documents, send one request per file. ## Upload a document ```http POST https://secure.alterestate.com/api/v1/files/new/ ``` Authentication: `Authorization: Token your_api_key_here` > **Server-side only.** Call this endpoint from your backend only. The account token acts as the user who owns it and can read and change the agency’s contacts, deals and properties. Never put it in a website, a mobile app or any code that runs in the browser: anyone can open the developer tools and copy it. Have your frontend call your own server, and let your server call AlterEstate. | Parameter | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `file` | body | file | yes | The document. Any type, up to 100 MB. | | `property` | body | string | yes | uid of the property that receives the document, from Create a property or List properties. Not the numeric cid. | | `name` | body | string | yes | Name shown in the dashboard. The dashboard sends the original filename. | | `description` | body | string | no | Optional note about the document. | Example request: ```bash curl --request POST \ --url 'https://secure.alterestate.com/api/v1/files/new/' \ --header 'Authorization: Token your_api_key_here' \ --header 'Accept: application/json' \ --form 'file=@title-deed.pdf;type=image/jpeg' \ --form 'property=JSORJ9S5AY' \ --form 'name=title-deed.pdf' \ --form 'description=Certified copy, 2026' ``` Response 201 Created: ```json { "id": "884213", "uid": "K7QW2M9XPL", "name": "title-deed.pdf", "description": "Certified copy, 2026", "file": "https://d2p0bx8wfdkjkb.cloudfront.net/static/files/example/title-deed.pdf", "property": "JSORJ9S5AY", "contact": null, "deal": null, "project": null, "category": null, "is_public": false, "is_external": false, "deleted": false, "timestamp": "2026-11-09T14:32:10.512345-04:00" } ``` Response 400 Bad Request: ```json { "file": [ "El tamaño máximo del archivo no debe superar los 100 MB." ] } ``` Response 400 Unknown property: ```json { "property": [ "Object with uid=XXXXXXXXXX does not exist." ] } ``` ## List the documents of a property ```http GET https://secure.alterestate.com/api/v1/files/ ``` Authentication: `Authorization: Token your_api_key_here` > **Server-side only.** Call this endpoint from your backend only. The account token acts as the user who owns it and can read and change the agency’s contacts, deals and properties. Never put it in a website, a mobile app or any code that runs in the browser: anyone can open the developer tools and copy it. Have your frontend call your own server, and let your server call AlterEstate. | Parameter | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `property_uid` | query | string | yes | uid of the property. Without it the response lists every document of your agency, including those of contacts and deals. | Example request: ```bash curl --request GET \ --url 'https://secure.alterestate.com/api/v1/files/?property_uid=JSORJ9S5AY' \ --header 'Authorization: Token your_api_key_here' \ --header 'Accept: application/json' ``` Response 200 OK: ```json [ { "id": 884213, "uid": "K7QW2M9XPL", "name": "title-deed.pdf", "description": "Certified copy, 2026", "file": "https://d2p0bx8wfdkjkb.cloudfront.net/static/files/example/title-deed.pdf", "property": { "cid": 292960, "uid": "JSORJ9S5AY", "name": "Modern apartment in Naco" }, "timestamp": "2026-11-09T14:32:10.512345-04:00" } ] ``` ## What to know - company and created_by come from the token. Do not send them. - The list is not paginated and is sorted newest first. Deleted documents are left out. - file in the response is the download URL. Treat it as private and do not publish it or show it outside your agency. - Deleting a document is done from the dashboard. It requires a role with permission to delete data. - An upload that does not come from the AlterEstate dashboard is recorded for support, with the property, the file name, its size and its type. The contents of the file are not recorded. - Like every endpoint that uses the account token, call these from your backend, never from browser or mobile app code. Upload one PDF to a property: ```bash curl -X POST 'https://secure.alterestate.com/api/v1/files/new/' \ -H 'Authorization: Token YOUR_ACCOUNT_TOKEN' \ -F 'property=JSORJ9S5AY' \ -F 'name=title-deed.pdf' \ -F 'file=@title-deed.pdf' ``` ## Status codes | Status | Meaning | | --- | --- | | 200 | The list of documents. | | 201 | The document was saved. The body is the new document. | | 400 | The file is missing or larger than 100 MB, name is missing, or your agency has no property with that uid. The response names the field. | | 401 | The account token is missing or invalid. | | 500 | Server error while processing the request. | - [Upload the cover and gallery photos](https://dev.alterestate.com/properties/photos) - [Find a property uid](https://dev.alterestate.com/properties/list) ## FAQ ### How do I attach a PDF to a property? POST https://secure.alterestate.com/api/v1/files/new/ as multipart/form-data with file, name and property set to the property uid. Send Authorization: Token from your backend. ### Are property documents public? No. They appear only in the dashboard, for users of your agency. They are not shown on the website or sent to portals. ### Can I upload several documents at once? No. Send one request per file. The dashboard does the same when you drop several files.