Files API

{
  "owner_user_id": "u_1001",
  "file_kind": "kyc_document",
  "allowed_content_types": ["image/jpeg", "application/pdf"],
  "max_size_bytes": 10485760,
  "original_filename": "passport.pdf",
  "content_type": "application/pdf",
  "content_base64": "JVBERi0x…"
}
→ 201 { "file_id": "file_…", "status": "active", "size_bytes": 842119 }

DevSewa validates size and content type, derives the tenant, creates the grant and finalises the upload. Your backend never receives the grant or a private vault URL.

Send subject_user_id. DevSewa verifies the file in the derived tenant, consumes the one-time grant and returns the content to your backend. Never relay this response through public browser code without your own authorization check.