Prospect Files

Files up to 25 MB are attached in two steps so the bytes never pass through the API:

POST /v1/prospects/{id}/files/upload-url with file_name and content_type. You get a presigned upload_url (valid 5 minutes) and an s3_key.
PUT the file bytes to upload_url with the returned headers.
POST /v1/prospects/{id}/files with s3_key, file_name, file_size, and content_type to attach it.

Method	Path	Description
`GET`	`/v1/prospects/{id}/files`	List files
`POST`	`/v1/prospects/{id}/files/upload-url`	Get an upload target
`POST`	`/v1/prospects/{id}/files`	Attach an uploaded file
`GET`	`/v1/prospects/{id}/files/{file_id}/download`	302 to a 5-minute signed URL (`?redirect=false` returns JSON)
`DELETE`	`/v1/prospects/{id}/files/{file_id}`	Delete the file and its object

Request example

1234567891011121314# 1. Ask for an upload target
curl -X POST "https://api.v2.dealmachine.com/v1/prospects/prospect_8812/files/upload-url" \
  -H "Authorization: Bearer dm_sk_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{ "file_name": "inspection.pdf", "content_type": "application/pdf" }'

# 2. PUT the bytes
curl -X PUT "$UPLOAD_URL" -H "Content-Type: application/pdf" --data-binary @inspection.pdf

# 3. Attach it
curl -X POST "https://api.v2.dealmachine.com/v1/prospects/prospect_8812/files" \
  -H "Authorization: Bearer dm_sk_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{ "s3_key": "$S3_KEY", "file_name": "inspection.pdf", "file_size": 482113, "content_type": "application/pdf" }'

Response example

1234567891011{
  "data": {
    "id": "file_2",
    "prospect_id": "prospect_8812",
    "file_name": "inspection.pdf",
    "file_size": 482113,
    "content_type": "application/pdf",
    "uploaded_by": { "type": "api_key", "user_id": null, "name": null, "api_key_id": "key_9f1c..." },
    "created_at": "2026-08-26T16:25:00.000Z"
  }
}