> ## Documentation Index > Fetch the complete documentation index at: https://docs.dwsoffshorepartners.com/llms.txt > Use this file to discover all available pages before exploring further. # Create an upload link > Read the POST /upload-links request and response contract generated from the live Ultiwrite OpenAPI document. This reference is generated from the [canonical Ultiwrite OpenAPI contract](https://dwsoffshorepartners.com/.well-known/openapi.json), shared with the native API documentation. [Follow the quickstart](https://docs.dwsoffshorepartners.com/quickstart.md) to obtain approved account access before calling the API. ## OpenAPI ````yaml https://dwsoffshorepartners.com/.well-known/openapi.json POST /upload-links openapi: 3.1.0 info: title: Ultiwrite API version: '2026-11-01' description: >- Ultiwrite is operated by DWS Offshore Fund dba Ultiwrite. Ultiwrite examines the documents and evidence behind opportunities, organizations, counterparties, acquisitions, financings and portfolios, and returns released findings: source economics, document integrity, material contradictions, unresolved claims and the next diligence move. The API never renders an autonomous approve or decline. Partner API (dashboard API key or OAuth 2.1): explicitly approved accounts submit evidence, continue asynchronous processing and read the released report. Polling uses API requests but no additional analysis credits. Reports are never assumed to be immediate. Provisioned routes authenticate with an admin-issued uw_live_ API key and are listed by name only. Versioning: the major version is in the path (/api/v1). Within v1, changes are additive; a field or operation is removed only after a deprecation notice in this document (deprecated: true) and the changelog. Response header Ultiwrite-Api-Version identifies the contract revision. API access requires an explicit administrator grant, independent of paid plan. Monthly and fixed-minute request limits are pooled across every key and partner OAuth grant on the account. Every admitted request, including polling and authenticated validation errors, uses one request; failed authentication and quota denials do not. Analysis credits use the existing separate ledger. Exceeding a limit returns 429 with Retry-After. contact: name: Ultiwrite url: https://dwsoffshorepartners.com/contact termsOfService: https://dwsoffshorepartners.com/terms servers: - url: https://dwsoffshorepartners.com/api/v1 description: Production v1 security: [] tags: - name: Account description: Who the token acts for, what the API supports, and analysis allowance. - name: Cases description: Submit evidence packages and follow the asynchronous analysis workflow. - name: Results description: Released findings and Decision Briefs. Reads never run the engine. - name: Reports description: Delivery options for released reports. - name: Provisioned (API key) description: Pre-existing provisioned server-to-server routes. externalDocs: description: Developer documentation url: https://dwsoffshorepartners.com/docs/api paths: /upload-links: post: tags: - Cases summary: Issue a signed upload link for large packages description: >- A single-use signed link bound to this credential and organization, valid for up to 30 minutes and never beyond an API key’s expiry. Current key status and API approval are checked when it is used. Open it in a browser for the guided uploader, or drive the signed staged-upload protocol. The resulting case is listed by GET /cases. Treat the link as a secret. operationId: createUploadLink requestBody: required: false description: Optional document-forensics preference carried by the link. content: application/json: schema: $ref: '#/components/schemas/CreateUploadLink' responses: '201': description: Upload link. headers: X-Request-Id: description: Request correlation id. schema: type: string X-Api-Requests-Limit: description: >- Monthly account API request limit. Present after successful admission. schema: type: integer minimum: 0 X-Api-Requests-Remaining: description: >- Monthly requests remaining immediately after this request was admitted; other concurrent requests may reduce it. schema: type: integer minimum: 0 X-Api-Requests-Reset: description: >- Next UTC calendar-month reset as an ISO 8601 timestamp. Present after successful admission. schema: type: string format: date-time content: application/json: schema: $ref: '#/components/schemas/UploadLink' '400': description: >- Invalid input. No new evidence package was accepted. If authenticated and admitted, the request counts toward the API request allowance. headers: X-Request-Id: description: Request correlation id. schema: type: string X-Api-Requests-Limit: description: >- Monthly account API request limit. Present after successful admission. schema: type: integer minimum: 0 X-Api-Requests-Remaining: description: >- Monthly requests remaining immediately after this request was admitted; other concurrent requests may reduce it. schema: type: integer minimum: 0 X-Api-Requests-Reset: description: >- Next UTC calendar-month reset as an ISO 8601 timestamp. Present after successful admission. schema: type: string format: date-time content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: >- Missing, invalid, expired or revoked token, or a token issued for another resource. See WWW-Authenticate. headers: X-Request-Id: description: Request correlation id. schema: type: string X-Api-Requests-Limit: description: >- Monthly account API request limit. Present after successful admission. schema: type: integer minimum: 0 X-Api-Requests-Remaining: description: >- Monthly requests remaining immediately after this request was admitted; other concurrent requests may reduce it. schema: type: integer minimum: 0 X-Api-Requests-Reset: description: >- Next UTC calendar-month reset as an ISO 8601 timestamp. Present after successful admission. schema: type: string format: date-time content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- Explicit account API approval is missing or the credential lacks a required scope. headers: X-Request-Id: description: Request correlation id. schema: type: string X-Api-Requests-Limit: description: >- Monthly account API request limit. Present after successful admission. schema: type: integer minimum: 0 X-Api-Requests-Remaining: description: >- Monthly requests remaining immediately after this request was admitted; other concurrent requests may reduce it. schema: type: integer minimum: 0 X-Api-Requests-Reset: description: >- Next UTC calendar-month reset as an ISO 8601 timestamp. Present after successful admission. schema: type: string format: date-time content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: >- Not found in the authorized organization, or the API is not enabled. Another organization’s records are indistinguishable from absent ones. headers: X-Request-Id: description: Request correlation id. schema: type: string X-Api-Requests-Limit: description: >- Monthly account API request limit. Present after successful admission. schema: type: integer minimum: 0 X-Api-Requests-Remaining: description: >- Monthly requests remaining immediately after this request was admitted; other concurrent requests may reduce it. schema: type: integer minimum: 0 X-Api-Requests-Reset: description: >- Next UTC calendar-month reset as an ISO 8601 timestamp. Present after successful admission. schema: type: string format: date-time content: application/json: schema: $ref: '#/components/schemas/Error' '415': description: Unsupported request media type. headers: X-Request-Id: description: Request correlation id. schema: type: string X-Api-Requests-Limit: description: >- Monthly account API request limit. Present after successful admission. schema: type: integer minimum: 0 X-Api-Requests-Remaining: description: >- Monthly requests remaining immediately after this request was admitted; other concurrent requests may reduce it. schema: type: integer minimum: 0 X-Api-Requests-Reset: description: >- Next UTC calendar-month reset as an ISO 8601 timestamp. Present after successful admission. schema: type: string format: date-time content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: >- Account monthly request allowance, rate limit or concurrency budget exceeded. See Retry-After. headers: X-Request-Id: description: Request correlation id. schema: type: string X-Api-Requests-Limit: description: >- Monthly account API request limit. Present after successful admission. schema: type: integer minimum: 0 X-Api-Requests-Remaining: description: >- Monthly requests remaining immediately after this request was admitted; other concurrent requests may reduce it. schema: type: integer minimum: 0 X-Api-Requests-Reset: description: >- Next UTC calendar-month reset as an ISO 8601 timestamp. Present after successful admission. schema: type: string format: date-time Retry-After: description: >- Suggested delay in seconds before retrying; present for rate/quota denials and transient failures with a known retry window. schema: type: integer minimum: 1 content: application/json: schema: $ref: '#/components/schemas/Error' '503': description: Temporarily unavailable. See Retry-After. No completion is claimed. headers: X-Request-Id: description: Request correlation id. schema: type: string X-Api-Requests-Limit: description: >- Monthly account API request limit. Present after successful admission. schema: type: integer minimum: 0 X-Api-Requests-Remaining: description: >- Monthly requests remaining immediately after this request was admitted; other concurrent requests may reduce it. schema: type: integer minimum: 0 X-Api-Requests-Reset: description: >- Next UTC calendar-month reset as an ISO 8601 timestamp. Present after successful admission. schema: type: string format: date-time Retry-After: description: >- Suggested delay in seconds before retrying; present for rate/quota denials and transient failures with a known retry window. schema: type: integer minimum: 1 content: application/json: schema: $ref: '#/components/schemas/Error' security: - UltiwriteApiKey: [] - UltiwriteOAuth: - ultiwrite:read - ultiwrite:evidence components: schemas: CreateUploadLink: type: object additionalProperties: false properties: documentForensics: type: boolean default: false UploadLink: type: object additionalProperties: false required: - url - expiresAt - singleUse - documentForensics - usage - security properties: url: type: string format: uri expiresAt: type: string format: date-time singleUse: type: boolean const: true documentForensics: type: boolean usage: type: string security: type: string Error: type: object additionalProperties: false required: - error properties: error: type: object additionalProperties: false required: - code - message - requestId properties: code: type: string description: >- Stable machine-readable code, for example invalid_input, invalid_token, api_access_denied, insufficient_scope, api_quota_exceeded, not_found, choice_frozen, file_too_large, refused_content, rate_limited, deadline, service_unavailable. message: type: string description: >- Safe human-readable explanation. Never contains credentials, stack traces or document text. requestId: type: string description: Echo of the X-Request-Id response header. Quote it to support. securitySchemes: UltiwriteApiKey: type: http scheme: bearer bearerFormat: ultiwrite_live_* description: >- Create a key at /settings/api after an administrator approves your account. The key is shown once, can be revoked, and shares the account request allowance with other keys and partner OAuth grants. Send only in Authorization. These keys are not accepted by MCP or the legacy provisioned routes. UltiwriteOAuth: type: oauth2 description: >- OAuth 2.1 authorization code with PKCE (S256), public clients (token_endpoint_auth_method none). Register a client (RFC 7591) at https://dwsoffshorepartners.com/api/integrations/ultiwrite/oauth/register; registration accepts only approved HTTPS callbacks or a native loopback callback http://127.0.0.1:/callback with application_type native. Send resource=https://dwsoffshorepartners.com/api/v1 (RFC 8707) on the authorization and token requests; tokens for any other resource are refused. Access tokens last 10 minutes; refresh tokens last 14 days and rotate; authorization codes expire after 60 seconds. flows: authorizationCode: authorizationUrl: >- https://dwsoffshorepartners.com/api/integrations/ultiwrite/oauth/authorize tokenUrl: >- https://dwsoffshorepartners.com/api/integrations/ultiwrite/oauth/token refreshUrl: >- https://dwsoffshorepartners.com/api/integrations/ultiwrite/oauth/token scopes: ultiwrite:read: >- Read cases, status, released reports, Decision Briefs and delivery options in the authorized organization. ultiwrite:evidence: >- Submit authorized evidence for analysis in the authorized organization. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.