> ## Documentation Index > Fetch the complete documentation index at: https://help.polygon-one.com/llms.txt > Use this file to discover all available pages before exploring further. # Attach Evidence > Attach evidence to the supplier article named by `supplierId` + `articleId` (for per-order origin: the per-order copy's id and its `supplierLinks[].supplierId`). For a new file, send `uploadedS3Key`, `uploadedFileName`, `uploadedFileSize` and `uploadedMimeType` after using the upload URL; the `file` field instead is for small files only (at most 4.5 MB, the platform request cap). To attach a file already stored by your company to another supplier article, send only its `reuseS3Key` from an earlier successful response — no second upload or metadata fields. Exactly one of these three upload sources is allowed. Each call attaches to one supplier article and starts asynchronous analysis. The document is recorded as uploaded by you (the API key's user), not by the supplier. No supplier link of your company for `supplierId` + `articleId` answers `404` (another company's link answers the same); an `uploadedS3Key` not issued to your company, or a `reuseS3Key` that your company does not own, answers `403`. Requires `evidence:write`. Deleting and re-analysing evidence is not available to API keys (`403`; the body is `{ "error": "Not available for API keys" }`, or `{ "error": "Forbidden" }` when the key lacks the endpoint's permission). Flow and error cases: [Per-order origin via ERP](https://help.polygon-one.com/en/api-reference/orders.md#per-order-origin-via-erp). ## OpenAPI ````yaml POST /api/v1/evidence openapi: 3.1.0 info: title: Polygon One Compliance API description: >- REST API for connecting ERP and other business systems to Polygon One. It covers both compliance modules: **EUDR** (EU Deforestation Regulation) — articles, suppliers, plots, evidence, orders and Due Diligence Statements — and **PPWR** (EU Packaging and Packaging Waste Regulation) — packaging components and units, documents, Declarations of Conformity, the SKU quantity feed and volume reports. Authenticate every request with an API key created in Settings → API Keys, sent as `Authorization: Bearer `. Each key carries scopes (e.g. `articles:read`, `packaging:write`) that limit what it may read and write. Versioning: `v1` changes only additively — new endpoints, new optional request fields and new response fields may appear, nothing documented is removed or changed in meaning. Ignore response fields you do not know. Guides and walkthroughs: https://help.polygon-one.com/api-reference/introduction version: 1.0.0 contact: name: Polygon One Support email: help@polygon-one.eu servers: - url: https://app.polygon-one.com description: Production Server security: - bearerAuth: [] tags: - name: Articles description: >- EUDR articles: your products and purchased goods, their HS code, EUDR relevance and supplier links. - name: Suppliers description: EUDR suppliers and their links to articles. - name: Plots description: >- EUDR plots of land (geolocations): create, validate, link to supplier articles, read the geo analysis and its report. - name: Evidence description: >- EUDR evidence documents attached to a supplier article (legal compliance documents, questionnaires). - name: Orders description: >- Purchase and sale orders and their lines; the read-back of the DDS references linked to each order. - name: Import Jobs description: >- Status and result of an asynchronous batch import (articles, suppliers, orders, PPWR quantities). - name: Readiness description: Action-scoped readiness snapshots for owned EUDR and PPWR resources. - name: DDS Statements description: >- EUDR Due Diligence Statements: create, read, update the TRACES numbers, delete. - name: PPWR Packaging Data description: >- PPWR master data: packaging components, packaging units, their sizes, bills of materials and article links. - name: PPWR Documents description: >- Upload supporting documents (test reports, declarations, technical documentation) to a packaging unit or component. - name: PPWR Declarations of Conformity description: Read Declarations of Conformity and download their files. - name: PPWR Quantities & Volume Reports description: >- The SKU quantity feed, aggregate material tonnage and the generated volume reports (Mengenmeldung). paths: /api/v1/evidence: post: tags: - Evidence summary: Attach Evidence description: >- Attach evidence to the supplier article named by `supplierId` + `articleId` (for per-order origin: the per-order copy's id and its `supplierLinks[].supplierId`). For a new file, send `uploadedS3Key`, `uploadedFileName`, `uploadedFileSize` and `uploadedMimeType` after using the upload URL; the `file` field instead is for small files only (at most 4.5 MB, the platform request cap). To attach a file already stored by your company to another supplier article, send only its `reuseS3Key` from an earlier successful response — no second upload or metadata fields. Exactly one of these three upload sources is allowed. Each call attaches to one supplier article and starts asynchronous analysis. The document is recorded as uploaded by you (the API key's user), not by the supplier. No supplier link of your company for `supplierId` + `articleId` answers `404` (another company's link answers the same); an `uploadedS3Key` not issued to your company, or a `reuseS3Key` that your company does not own, answers `403`. Requires `evidence:write`. operationId: createEvidence requestBody: required: true content: multipart/form-data: schema: $ref: '#/components/schemas/EvidenceInput' examples: upload: summary: Attach a newly uploaded file value: supplierId: 5a1d8c3e-7f24-4b9a-a6e0-1c3f5b8d2e94 articleId: 7c4e2b19-3a85-4d6f-b210-8e9a5c1d7f36 uploadedS3Key: >- pending/operator/3f6c2a8e-5b1d-4c7e-9a2f-6d8b1e4c0a17/6a0e4c8f-2b57-4d93-8b1f-0e6c4a2d9f85-harvest-licence-2025.pdf uploadedFileName: harvest-licence-2025.pdf uploadedFileSize: '482113' uploadedMimeType: application/pdf evidenceType: legal_compliance reuse: summary: >- Attach the same stored file to another article without uploading it again value: supplierId: 5a1d8c3e-7f24-4b9a-a6e0-1c3f5b8d2e94 articleId: 1a7c3e9d-6b28-4f50-8d14-2b9e6c3a7f41 reuseS3Key: >- evidence/2e8f6a3c-9d17-4b52-8c4a-7f1e3d9b0a65/0f7b2d9e-5c31-4a86-b4e0-8d2a6c1f9e57-harvest-licence-2025.pdf evidenceType: legal_compliance responses: '201': description: Evidence attached content: application/json: schema: $ref: '#/components/schemas/Evidence' example: id: 8d2c6f0a-3e95-4a78-b1d4-9f0e5a3c7b62 s3Key: >- evidence/2e8f6a3c-9d17-4b52-8c4a-7f1e3d9b0a65/0f7b2d9e-5c31-4a86-b4e0-8d2a6c1f9e57-harvest-licence-2025.pdf fileName: harvest-licence-2025.pdf fileSize: 482113 mimeType: application/pdf message: Evidence document uploaded successfully. Analysis in progress. '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': description: >- This supplier article already has a live document with these exact bytes — nothing was written. Re-send with `allowDuplicate=true` to attach a second copy anyway. content: application/json: schema: $ref: '#/components/schemas/EvidenceDuplicate' example: error: duplicate existing: id: 8d2c6f0a-3e95-4a78-b1d4-9f0e5a3c7b62 fileName: harvest-licence-2025.pdf '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalError' components: schemas: EvidenceInput: type: object properties: supplierId: type: string format: uuid description: >- The supplier of the supplier link (`supplierLinks[].supplierId` of the article). articleId: type: string format: uuid description: The article — for per-order origin, the per-order fork's id. uploadedS3Key: type: string description: >- The `s3Key` from `POST /api/v1/evidence/upload-url`, after the `PUT`. uploadedFileName: type: string description: File name; required with `uploadedS3Key`. uploadedFileSize: type: string description: >- Size in bytes (a form field, so a string); required with `uploadedS3Key`. uploadedMimeType: type: string description: MIME type; required with `uploadedS3Key`. reuseS3Key: type: string description: >- The `s3Key` returned by an earlier successful `POST /api/v1/evidence`. Reuses that company-owned file for this target without another upload; do not send `file` or `uploaded*` fields with it. file: type: string description: >- The file itself, instead of the `uploaded*` fields — small files only (at most 4.5 MB, the platform request cap); use the upload URL for anything larger. evidenceType: type: string enum: - legal_compliance - questionnaire description: Default `legal_compliance`. note: type: string description: >- Free-text note for the document. It is passed to the document analysis as context. certificationScheme: type: string description: >- The certification scheme the document belongs to (e.g. `FSC`). It is passed to the document analysis as a hint, and the document is then analysed as a risk-mitigation certificate. allowDuplicate: type: string enum: - 'true' description: >- Send `true` to store a second copy of a file that a `409` reported as a duplicate. required: - supplierId - articleId Evidence: type: object properties: id: type: string format: uuid description: The new evidence document's id. s3Key: type: string description: Storage key of the stored file. fileName: type: string description: File name as stored. fileSize: type: number description: Size of the stored file in bytes. mimeType: type: string description: MIME type of the stored file. message: type: string description: Human-readable confirmation, e.g. that the analysis is in progress. required: - id - s3Key - fileName - fileSize - mimeType - message EvidenceDuplicate: type: object properties: error: type: string enum: - duplicate description: Always `duplicate`. existing: type: object properties: id: type: string description: UUID of the existing evidence document with the same bytes. fileName: type: string description: File name of the existing document. required: - id - fileName description: The live document that already has these exact bytes. required: - error - existing ErrorResponse: type: object properties: error: type: string description: >- Human-readable message, or a stable machine key (e.g. `batchTooLarge`, `overwriteRequired`, `duplicate`) on the batch, PPWR and upload endpoints. code: type: string description: >- Stable machine code on some `400` and `409` answers, e.g. `plot_geometry_invalid` or `FORK_HAS_ORDER`. Match on it rather than on `error`. Further flat keys may accompany it (e.g. `precisionDigits`, `field`). details: type: array items: $ref: '#/components/schemas/ValidationIssue' description: The validation issues on a `400` validation error. warnings: type: array items: type: object properties: type: type: string enum: - duplicateName - duplicateEan description: >- `duplicateName`: a live article of your company already has this name. `duplicateEan`: a live article already has this EAN. existingInternalArticleNr: type: string description: >- `duplicateName` only: internal article number of the existing article. existingArticleName: type: string description: '`duplicateEan` only: name of the existing article.' required: - type description: >- `POST /articles` `409` only: soft duplicate warnings. Resend with `acknowledgeWarnings: true` to create the article anyway. required: - error additionalProperties: {} description: >- Error body of every endpoint except the `429` the edge answers. Some errors add flat machine-readable keys next to `error`, e.g. `maxBatchSize` on `413 batchTooLarge` or `confirmUpdateCount` on `409 overwriteRequired`. RateLimitedResponse: type: object properties: error: type: object properties: code: type: string enum: - rate_limited description: Always `rate_limited`. message: type: string description: Human-readable explanation. required: - code - message description: Unlike every other error body, `error` is an object here. required: - error ValidationIssue: type: object properties: code: type: string description: >- Machine code of the issue, e.g. `invalid_type`, `too_small`, `custom`. path: type: array items: anyOf: - type: string - type: number description: >- Location of the offending value in the request: object keys and 0-based array positions. message: type: string description: >- Human-readable English explanation. The wording may change; match on `code` and `path`. required: - code - path - message additionalProperties: {} description: >- One validation issue. Issue-specific keys (e.g. `expected`, `minimum`) may accompany the three listed. responses: BadRequest: description: Invalid request data content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Validation failed details: - origin: string code: too_small minimum: 1 inclusive: true path: - address - street message: Address is required. Unauthorized: description: Invalid or expired API key, or the key's user account is not active. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Invalid or expired API key Forbidden: description: Insufficient permissions for this resource content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Forbidden NotFound: description: Resource not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Resource not found TooManyRequests: description: >- Rate limit exceeded: currently 1000 requests per 60 seconds per client IP across all `/api` paths. Issued by the edge before the application runs, so the JSON body differs from every other error: `error` is an object. A `429` with an HTML body instead of JSON means the request carried no API key. content: application/json: schema: $ref: '#/components/schemas/RateLimitedResponse' example: error: code: rate_limited message: … InternalError: description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Internal server error securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: API Key description: >- API key generated in Settings > API Keys. Include as `Authorization: Bearer `. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.