> ## Documentation Index > Fetch the complete documentation index at: https://docs.codaclean.io/llms.txt > Use this file to discover all available pages before exploring further. # Obtenir des accès d'upload CODA > Returns temporary AWS credentials to upload CODA files to Codaclean's S3 bucket, under the returned `prefix` only. Uploading must be enabled for the accounting firm by Codaclean. Otherwise, the call returns `403 upload_not_allowed`. **Required scope:** `files:write` ## OpenAPI ````yaml POST /coda-files/upload openapi: 3.1.0 info: title: Codaclean API version: '1.0' description: > The Codaclean external API lets partner software (accounting tools, practice management software, sync agents) integrate with Codaclean on behalf of an accounting firm: manage its customers, request CODA and CODB mandates, and retrieve the CODA and CODB files Codaclean receives for them. servers: - url: https://api.codaclean.io/v1 description: Production - url: https://api.test.codaclean.io/v1 description: Staging security: - apiKeyAuth: [] bearerAuth: [] tags: - name: Authentication description: Obtain and refresh the ID token sent with every other call. - name: Utilities description: Connectivity check. - name: Customers description: The customers (client companies) managed by the accounting firm. - name: Bank accounts description: Bank accounts (IBANs) linked to a customer. - name: Customer payroll providers description: Payroll providers (social secretariats) linked to a customer. - name: Mandates description: CODA mandates (per bank account) and CODB mandates (per payroll provider). - name: Reference data description: Banks and payroll providers known to Codaclean. - name: CODA files description: Bank statement files in CODA format. - name: CODB files description: Payroll files in CODB format, delivered by payroll providers. paths: /coda-files/upload: post: tags: - CODA files summary: Get CODA upload credentials description: > Returns temporary AWS credentials to upload CODA files to Codaclean's S3 bucket, under the returned `prefix` only. Uploading must be enabled for the accounting firm by Codaclean. Otherwise, the call returns `403 upload_not_allowed`. **Required scope:** `files:write` operationId: getCodaUploadCredentials responses: '200': description: Temporary upload credentials. content: application/json: schema: $ref: '#/components/schemas/UploadCredentials' examples: credentials: summary: Upload credentials value: accessKeyId: ASIAIOSFODNN7EXAMPLE secretAccessKey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY sessionToken: IQoJb3JpZ2luX2VjEXAMPLE_SESSION_TOKEN bucketName: codaclean-uploads prefix: uploads/3f1c2a9e-7b4d-4e8a-9c21-5d6e7f8a9b0c expirationUtc: '2026-09-26T13:33:38.000Z' '401': $ref: '#/components/responses/Unauthorized' '403': description: Missing scope, or `upload_not_allowed`. content: application/json: schema: $ref: '#/components/schemas/Error' examples: forbiddenScope: summary: API key without files:write value: message: 'Missing required scope: files:write' code: forbiddenScope noApiKey: summary: No API key value: message: Forbidden invalidApiKey: summary: Invalid API key value: message: Forbidden '429': $ref: '#/components/responses/TooManyRequests' '502': description: >- `sts_assume_role_failed` — the credentials could not be issued. Retry later. content: application/json: schema: $ref: '#/components/schemas/Message' examples: stsAssumeRoleFailed: summary: Credentials could not be issued value: message: sts_assume_role_failed components: schemas: UploadCredentials: type: object description: >- Temporary AWS credentials allowing `s3:PutObject` under `//` only. properties: accessKeyId: type: string secretAccessKey: type: string sessionToken: type: string bucketName: type: string prefix: type: string description: Key prefix to upload under (`uploads/`). expirationUtc: type: string format: date-time Error: type: object description: > Error body. `code` is a stable, machine-readable token; it is present on errors returned by the customers, mandates and reference-data endpoints. Some errors carry extra keys, such as `fields` or `candidates`. required: - message properties: message: type: string description: Human-readable description. Do not parse it. code: type: string description: | Machine-readable error code. **See also:** [Errors](/api/errors#error-codes) fields: type: array items: type: string description: >- Offending fields. Present with `unknownField` and `fieldNotUpdatable`. candidates: type: array description: Present with `connectorSelectionRequired`. items: $ref: '#/components/schemas/ConnectorCandidate' Message: type: object description: Confirmation returned by actions that do not return a resource. required: - message properties: message: type: string ConnectorCandidate: type: object properties: connectorId: type: integer name: type: string bicCode: type: string available: type: boolean responses: Unauthorized: description: >- Missing, invalid or expired ID token, or user not allowed to use the API. content: application/json: schema: $ref: '#/components/schemas/Message' examples: noToken: summary: No ID token value: message: Unauthorized invalidToken: summary: Invalid or expired ID token value: message: Unauthorized TooManyRequests: description: Rate limit or quota exceeded for this API key. content: application/json: schema: $ref: '#/components/schemas/Message' examples: tooManyRequests: summary: Rate limit exceeded value: message: Too Many Requests securitySchemes: apiKeyAuth: type: apiKey in: header name: x-api-key description: >- Identifies the partner software. Issued by Codaclean. Required on every call, including `POST /token`. bearerAuth: type: http scheme: bearer bearerFormat: JWT (Cognito ID token) description: >- Identifies the user and their accounting firm. Send the `idToken` returned by `POST /token` as `Authorization: Bearer `. Valid for 1 hour. ````