# documentRequests.portal

View and send the requested receipt for your own purchase request. Use view, begin with the original file manifest, prepare each private upload, confirm each SHA-256, then complete. Uploading originals is separate from reading and matching the receipt; company finance access is never granted.

`POST /api/v1/contractor/documentRequests.portal`

Permissions: `contractor:read`, `contractor:write` · Roles: contractor

MCP tool: `contractor_document_requests_portal`

## Fields

#### action: "view"

| Field | Type | Required | Notes |
| --- | --- | --- | --- |
| `id` | string (ID) | Yes | The record's ID. |
| `action` | "view" | Yes |  |

#### action: "begin"

| Field | Type | Required | Notes |
| --- | --- | --- | --- |
| `id` | string (ID) | Yes | The record's ID. |
| `action` | "begin" | Yes |  |
| `files` | array of objects | Yes | 1–25 items. |
| `files[].filename` | string | Yes | The file's name, including its extension. 1–180 characters. |
| `files[].mimeType` | enum | Yes | The file's type, such as image/jpeg or application/pdf. One of: `application/pdf`, `image/jpeg`, `image/png`, `image/webp`, `image/heic`, `image/heif`. |
| `files[].sizeBytes` | integer | Yes | The file's size in bytes. 1 to 20971520. |
| `files[].sha256` | string | Yes | The SHA-256 hash of the file's exact bytes, as 64 lowercase hex characters. SHA-256 hash as 64 lowercase hex characters. |

#### action: "prepare"

| Field | Type | Required | Notes |
| --- | --- | --- | --- |
| `filename` | string | Yes | The file's name, including its extension. 1–180 characters. |
| `mimeType` | enum | Yes | The file's type, such as image/jpeg or application/pdf. One of: `application/pdf`, `image/jpeg`, `image/png`, `image/webp`, `image/heic`, `image/heif`. |
| `sizeBytes` | integer | Yes | The file's size in bytes. 1 to 20971520. |
| `sha256` | string | Yes | The SHA-256 hash of the file's exact bytes, as 64 lowercase hex characters. SHA-256 hash as 64 lowercase hex characters. |
| `id` | string (ID) | Yes | The record's ID. |
| `action` | "prepare" | Yes |  |

#### action: "confirm"

| Field | Type | Required | Notes |
| --- | --- | --- | --- |
| `id` | string (ID) | Yes | The record's ID. |
| `action` | "confirm" | Yes |  |
| `sha256` | string |  | The SHA-256 hash of the file's exact bytes, as 64 lowercase hex characters. SHA-256 hash as 64 lowercase hex characters. |

#### action: "complete"

| Field | Type | Required | Notes |
| --- | --- | --- | --- |
| `id` | string (ID) | Yes | The record's ID. |
| `action` | "complete" | Yes |  |

## Example request

```bash
curl https://app.getoatmilk.com/api/v1/contractor/documentRequests.portal \
  -H "Authorization: Bearer $OATMILK_OAUTH_TOKEN" \
  -H "X-Accounting-Organization: $OATMILK_ORGANIZATION_ID" \
  -H "Content-Type: application/json" \
  -d '{
  "id": "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d",
  "action": "view"
}'
```

Reference page: https://app.getoatmilk.com/docs/api/contractor/documentRequests.portal