Comp AI Uploads API

openapi: 3.2.0
info:
  title: Comp AI Uploads API
  description: Compliance automation API for SOC 2, ISO 27001, HIPAA, GDPR, evidence collection, policy workflows, Trust Access, security questionnaires, integrations, cloud checks, and device compliance.
  version: '1.0'
  contact: {}
servers:
- url: https://api.trycomp.ai
  description: Production API Server
tags:
- name: Uploads
paths:
  /v1/uploads/presign:
    post:
      description: Returns a presigned S3 URL plus the s3Key the file lands at. PUT the raw file bytes to that URL, then call the feature tool (e.g. upload-and-parse) with the s3Key instead of sending file data. Bytes never pass through the LLM.
      operationId: UploadsController_createUploadUrl_v1
      parameters:
      - name: X-Organization-Id
        in: header
        description: Organization ID (required for session auth, optional for API key auth)
        required: false
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateUploadUrlDto'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UploadUrlResponseDto'
      security:
      - apikey: []
      summary: Get a presigned URL to upload a file
      tags:
      - Uploads
      x-mint:
        metadata:
          title: Get a presigned URL to upload a file | Comp AI API
          sidebarTitle: Get a presigned URL to upload a file
          description: Returns a presigned S3 URL plus the s3Key the file lands at. PUT the raw file bytes to that URL, then call the feature tool (e.g. upload-and-parse) with the.
          og:title: Get a presigned URL to upload a file | Comp AI API
          og:description: Returns a presigned S3 URL plus the s3Key the file lands at. PUT the raw file bytes to that URL, then call the feature tool (e.g. upload-and-parse) with the.
      x-speakeasy-mcp:
        name: create-upload-url
components:
  schemas:
    UploadUrlResponseDto:
      type: object
      properties:
        uploadUrl:
          type: string
          description: Presigned S3 URL. Send the raw file bytes with a plain HTTP PUT to this URL — no Content-Type or auth headers are required (the signature is in the URL). Then call the feature endpoint with the s3Key below.
          example: https://bucket.s3.us-east-1.amazonaws.com/org_x/uploads/...?X-Amz-Signature=...
        s3Key:
          type: string
          description: The S3 key the file will land at. Pass this to the feature endpoint (e.g. questionnaire upload-and-parse) instead of base64 file data.
          example: org_abc/uploads/questionnaire/1735000000-questionnaire.xlsx
        expiresIn:
          type: number
          description: Seconds until the presigned URL expires.
          example: 900
      required:
      - uploadUrl
      - s3Key
      - expiresIn
    CreateUploadUrlDto:
      type: object
      properties:
        purpose:
          type: string
          enum:
          - questionnaire
          - policy_pdf
          - evidence
          - attachment
          - document
          - general
          description: What the file is for. Controls where the file is stored and which feature is expected to consume the returned s3Key.
          example: questionnaire
        fileName:
          type: string
          description: Original filename, used for the stored object name. Non-alphanumeric characters are replaced with underscores.
          example: vendor-security-questionnaire.xlsx
        fileType:
          type: string
          description: MIME type of the file (e.g. application/pdf, text/csv). Recorded as metadata and passed to the feature endpoint; the PUT itself is content-type agnostic, so the upload never fails on a header mismatch.
          example: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
      required:
      - purpose
      - fileName
      - fileType
  securitySchemes:
    apikey:
      type: apiKey
      in: header
      name: X-API-Key
      description: API key for authentication
x-speakeasy-timeout: 120000