---
description: "Upload and remove event files, protect bearer download links, and download invoice and ticket PDFs."
group: "Resources"
order: 28
---

# Files

Handle file responses separately from JSON records.

## Upload an event file {#upload-an-event-file}

POST `/{event_id}/files/upload.json` using multipart form data and field `data[Event][file_upload]`. Send `Accept: application/json`; let your HTTP client generate the multipart content-type boundary. Company administrator file-management rights are required. Multipart uploads use POST so the PHP/CakePHP request parser can populate the uploaded-file data.

```curl-·-uploads-a-file
curl --fail-with-body --user "$PAYDRO_EMAIL:$PAYDRO_PASSWORD" \
  --request POST \
  --header 'Accept: application/json' \
  --form "data[Event][file_upload]=@$FILE_PATH" \
  "$PAYDRO_ORIGIN/$EVENT_ID/files/upload.json"
```

Success includes `success:true`, `attachment_id` and `attachment` (the download URL). Invalid uploads use 400; storage allowance failures use 409. Existing format validation applies. The event's 25,000,000-byte storage allowance is a soft quota: an upload crossing it is accepted, subsequent uploads are blocked.

## Delete and download {#delete-and-download}

POST `/{event_id}/files/delete/{attachment_id}.json` removes an event-owned attachment with the same administrator permission. Require `success:true`.

General downloads use `https://files.{domain}/attachments/download/{attachment_id}`, with domain `paydro.com` or your configured local development domain. The files service is separate from the organizer origin. Reference samples use `PAYDRO_FILES_ORIGIN` for this operation.

These URLs are permanent bearer links: possession of the unguessable UUID grants download access without login. Treat the URL as a secret, share only with intended recipients, and don't publish private attachments in client logs. Deleting the attachment removes its download availability.

## Download order documents {#download-order-documents}

GET `/{event_id}/orders/download_invoice/{order_id}` or `/{event_id}/orders/download_tickets/{order_id}` for invoice/ticket PDFs. These customer links also use the bearer model: possession of the unguessable order UUID grants access without login. The server scopes the order to the event in the URL and checks document/payment state. Keep the URLs private. These paths return files, not JSON envelopes.

## Validate file responses {#validate-file-responses}

Check HTTP status, `Content-Type` and `Content-Disposition`; access failures can redirect or return HTML. Keep automatic redirect following disabled and avoid treating an HTML error page as a PDF. Restrict access, encrypt storage and apply the retention policy in [privacy and data handling](/en-us/docs/privacy-and-data.md).

CSV and Excel downloads are documented separately in [Exports](/en-us/docs/exports.md).