> ## Documentation Index > Fetch the complete documentation index at: https://docs.scan.com/llms.txt > Use this file to discover all available pages before exploring further. # Uploads a document on a referral > Attaches one file to a referral the authenticated group can access. `type` is `invoice`, `pfr` (letter of protection), `drivers_license`, `aob`, or `hcfa`. `file` is a base64 data URI, the same shape as `order_form`: `data:application/pdf;name=file.pdf;base64,...`. PDF, PNG, and JPEG only. The file must be 20 MB or smaller. Base64 expansion is already included in that limit. An invoice replaces the current invoice and keeps the previous file. A letter of protection is added alongside existing ones. A driver's license replaces the patient's current license. An assignment of benefits replaces the current one. An HCFA is stored on a visit. Send `visit_id` when the referral has more than one visit. With one visit, that visit is used. Returns 403 until Scan enables `referral_documents_create` for the group. ## OpenAPI ````yaml /openapi.yaml post /api/v2/referrals/{referral_id}/documents openapi: 3.1.0 info: title: Scan.com API version: v2 description: >- The Scan.com Partner API creates imaging referrals, schedules visits, and returns radiology reports. servers: - url: https://api.staging.scan.com description: Sandbox - url: https://api.scan.com description: Production security: - BearerAuth: [] tags: - name: Courier SSO description: >- Mint a one-time Courier portal SSO URL with the same Bearer token used for the rest of the API. - name: Webhooks description: >- Outbound HTTP POST notifications sent to your api_credentials.webhook_url when visit or notification status changes. Configure api_credentials on your LawFirm, Practice, CoordinationGroup, Insurance, Employer, or NurseCaseManagementGroup. - name: Order Documents description: >- Retrieve radiology report PDFs, DICOM imaging, and invoices for orders visible to the authenticated group. - name: Locations description: >- Search imaging centers near an address, or rank them for a referral after medical safety answers are on file. Partners submit a preferred center; Scan books the visit. - name: Testing description: Staging-only fixture bootstrap, status advancement, and test webhooks. - name: FHIR description: >- Opt-in FHIR R4 read shapes for DiagnosticReport and ImagingStudy. Not a FHIR server. paths: /api/v2/referrals/{referral_id}/documents: post: tags: - Referrals summary: Uploads a document on a referral description: > Attaches one file to a referral the authenticated group can access. `type` is `invoice`, `pfr` (letter of protection), `drivers_license`, `aob`, or `hcfa`. `file` is a base64 data URI, the same shape as `order_form`: `data:application/pdf;name=file.pdf;base64,...`. PDF, PNG, and JPEG only. The file must be 20 MB or smaller. Base64 expansion is already included in that limit. An invoice replaces the current invoice and keeps the previous file. A letter of protection is added alongside existing ones. A driver's license replaces the patient's current license. An assignment of benefits replaces the current one. An HCFA is stored on a visit. Send `visit_id` when the referral has more than one visit. With one visit, that visit is used. Returns 403 until Scan enables `referral_documents_create` for the group. operationId: createReferralDocument parameters: - name: referral_id in: path required: true description: Referral ID schema: type: string format: uuid requestBody: required: true content: application/json: schema: type: object required: - document properties: document: type: object required: - type - file properties: type: type: string enum: - invoice - pfr - drivers_license - aob - hcfa file: type: string description: >- Base64 data URI for a PDF, PNG, or JPEG. The file must be 20 MB or smaller. example: >- data:application/pdf;name=invoice.pdf;base64,JVBERi0xLjQK visit_id: type: string format: uuid description: >- Visit that receives an HCFA. Required when the referral has more than one visit. responses: '201': description: Document stored content: application/json: schema: type: object required: - type - filename - content_type - created_at properties: type: type: string enum: - invoice - pfr - drivers_license - aob - hcfa filename: type: string content_type: type: string created_at: type: string format: date-time '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/UnprocessableEntity' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalServerError' security: - BearerAuth: [] components: responses: Unauthorized: description: Missing, expired, or wrong-environment token headers: X-Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: unauthorized: value: error: Unauthorized message: Unauthorized type: authentication_error code: unauthorized request_id: abc-123 documentation_url: https://docs.scan.com/guides/errors#unauthorized expired: value: error: API token expired message: API token expired type: authentication_error code: api_token_expired request_id: abc-123 documentation_url: https://docs.scan.com/guides/errors#api_token_expired Forbidden: description: Endpoint is not enabled for this account headers: X-Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: This endpoint is not enabled for your account message: This endpoint is not enabled for your account type: permission_error code: endpoint_not_enabled request_id: abc-123 documentation_url: https://docs.scan.com/guides/errors#endpoint_not_enabled NotFound: description: Resource not found or not accessible to this account headers: X-Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Referral not found message: Referral not found type: not_found_error code: not_found request_id: abc-123 documentation_url: https://docs.scan.com/guides/errors#not_found UnprocessableEntity: description: Request body failed validation headers: X-Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Phone is invalid message: Phone is invalid type: validation_error code: unprocessable_entity request_id: abc-123 documentation_url: https://docs.scan.com/guides/errors#unprocessable_entity errors: - Phone is invalid TooManyRequests: description: Sandbox request allowance exhausted headers: X-Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Sandbox request limit reached message: Sandbox request limit reached type: rate_limit_error code: sandbox_request_limit_reached request_id: abc-123 documentation_url: https://docs.scan.com/guides/errors#sandbox_request_limit_reached InternalServerError: description: Unexpected internal error headers: X-Request-Id: $ref: '#/components/headers/RequestId' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Internal server error message: Internal server error type: api_error code: internal_error request_id: abc-123 documentation_url: https://docs.scan.com/guides/errors#internal_error headers: RequestId: description: Correlate this response with Scan support. schema: type: string schemas: ErrorResponse: type: object properties: error: type: string message: type: string type: type: string example: validation_error code: type: string example: unprocessable_entity request_id: type: string documentation_url: type: string errors: type: array items: type: string required: - error - message - type - code securitySchemes: BearerAuth: type: http scheme: bearer description: > `Authorization: Bearer `. Reuse the same token on later requests until it expires or is revoked. Do not request a new token for each call. The token does not expire after 24 hours. Sandbox tokens come from Get API keys and allow 2,000 successful requests or 7 days, or 90 days with an access code. Failed 4xx/5xx responses do not consume the allowance. Production tokens are issued from the group's API access tab and last until the expiry set there, or until revoked when no expiry is set. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.