Technical Documentation

File Upload Integration Docs: Presigned Endpoints

Learn how to implement secure direct file uploads for your forms — presigning requests, bypassing serverless limits, and verifying file attachments.

Last updated: 2026-09-22

Direct Answer

What is the core specification for file upload integration docs: presigned endpoints?

Form2Lead handles file uploads through a two-step direct presigned flow (POST https://form2lead.com/api/v1/f/YOUR_FORM_ID/presign). The browser uploads bytes directly to private encrypted cloud storage, bypassing serverless size limits, and submits form fields with attached file IDs.

// Example Code

// Step 1: Request presigned upload URL
POST /api/v1/f/YOUR_FORM_ID/presign
Content-Type: application/json

{ "fileName": "resume.pdf", "contentType": "application/pdf", "sizeBytes": 1048576 }

// Response: { fileId, uploadUrl, expiresIn: 300 }
// Step 2: PUT bytes directly to uploadUrl
// Step 3: POST /api/v1/f/YOUR_FORM_ID with { ...fields, _f2l_files: [fileId] }

Two-step upload lifecycle

Because serverless runtimes enforce strict request body ceilings, Form2Lead separates file bytes from form data. Your frontend requests a short-lived presigned upload URL, PUTs the raw file bytes directly to private cloud storage, and then submits the form with the returned file IDs in the _f2l_files array.

Server-side verification & storage

When the form submission arrives, Form2Lead runs an atomic verification: it confirms the presign belongs to this form, verifies file size and MIME type, binds the file to the submission, and increments your org storage quota in a single atomic transaction.

Error codes & limits

The presign endpoint returns clear HTTP error codes: 400 FILE_TYPE_NOT_ALLOWED for denied extensions (e.g. .exe, .html, .svg), 413 FILE_TOO_LARGE if a file exceeds tier limits, 400 TOO_MANY_FILES if file counts exceed your plan, and 402 STORAGE_QUOTA_EXCEEDED when your account storage is full.

Private gateway downloads

All files reside in private storage with public reads forbidden. Download links generated in your dashboard, email alerts, and CSV exports use secure HMAC capability tokens (GET /api/files/{fileId}?t={hmac}) that redirect to temporary 15-minute presigned download URLs.