Files

Handle file responses separately from JSON records.

Upload an event file

POST /{event_id}/files/upload.json using multipart form data and field data[Event][file_upload]. Send Accept: application/json; let your HTTP client generate the multipart content-type boundary. Company administrator file-management rights are required. Multipart uploads use POST so the PHP/CakePHP request parser can populate the uploaded-file data.

curl --fail-with-body --user "$PAYDRO_EMAIL:$PAYDRO_PASSWORD" \
  --request POST \
  --header 'Accept: application/json' \
  --form "data[Event][file_upload]=@$FILE_PATH" \
  "$PAYDRO_ORIGIN/$EVENT_ID/files/upload.json"

Success includes success:true, attachment_id and attachment (the download URL). Invalid uploads use 400; storage allowance failures use 409. Existing format validation applies. The event's 25,000,000-byte storage allowance is a soft quota: an upload crossing it is accepted, subsequent uploads are blocked.

Delete and download

POST /{event_id}/files/delete/{attachment_id}.json removes an event-owned attachment with the same administrator permission. Require success:true.

General downloads use https://files.{domain}/attachments/download/{attachment_id}, with domain paydro.com or your configured local development domain. The files service is separate from the organizer origin. Reference samples use PAYDRO_FILES_ORIGIN for this operation.

These URLs are permanent bearer links: possession of the unguessable UUID grants download access without login. Treat the URL as a secret, share only with intended recipients, and don't publish private attachments in client logs. Deleting the attachment removes its download availability.

Download order documents

GET /{event_id}/orders/download_invoice/{order_id} or /{event_id}/orders/download_tickets/{order_id} for invoice/ticket PDFs. These customer links also use the bearer model: possession of the unguessable order UUID grants access without login. The server scopes the order to the event in the URL and checks document/payment state. Keep the URLs private. These paths return files, not JSON envelopes.

Validate file responses

Check HTTP status, Content-Type and Content-Disposition; access failures can redirect or return HTML. Keep automatic redirect following disabled and avoid treating an HTML error page as a PDF. Restrict access, encrypt storage and apply the retention policy in privacy and data handling.

CSV and Excel downloads are documented separately in Exports.