# Upload recipient ID images ⚠️ front and back of the end consumer's ID (PII)

`POST /api/v1/shipments/identity-documents` — Token required · logistics:write · write · 2 pts

Shipments & logistics

Upload recipient ID images ⚠️ front and back of the end consumer's ID (PII). Off by default, apply to enable; pass-through only, never logged or cached

## Request body (JSON)

| Field | Type | Description |
| --- | --- | --- |
| `front_image` **required** | string | ⚠️ Front of the ID document (base64). Sensitive personal data of the end consumer: we pass it through only, never log or cache it. Off by default; apply explicitly. (max length 8000000) |
| `back_image` **required** | string | ⚠️ Back of the ID document (base64). Same as above. (max length 8000000) |
| `shipment_ids` | array<string> | Related shipment ids (optional). (0–100) |
| `recipient` | object | Recipient object { name, phone, address, country_code, state, city, postal_code }. country_code is AU / CN / NZ; state, city and postal_code are required for AU and NZ. Include the country code in the phone for cross-border parcels (e.g. +61…) and the street number in the address — incomplete addresses are the top cause of failed delivery. |
| `recipient.name` | string | Recipient name. (max length 128) |
| `recipient.phone` | string | Recipient phone; include the country code for cross-border parcels, e.g. +61… (max length 64) |
| `document_number` | string | ID number (optional). (max length 64) |

## Response

The envelope is decided by the HTTP status alone: 2xx with `{ data: … }` (lists also carry `page / page_size / has_more` or `total_count`); 4xx / 5xx with `{ error: { code, message, hint, request_id, doc_url } }`.

```json
{
  "data": { … }
}
```

A success response carries no human-readable text — no `code / result / msg`. `error.code` is the only field your code should branch on; `message` follows `Accept-Language`.

> Send an `Idempotency-Key` header (any unique string, e.g. a UUID) on writes: a network retry never creates a second order. Orders are drafts by default until a person confirms them in the ERP.

## Examples

### curl

```bash
curl -X POST "https://connect.everugg.net.au/api/v1/shipments/identity-documents" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: <uuid>" \
  -d '{ "front_image": "<front_image>", "back_image": "<back_image>" }'
```

### Python

```python
import requests

r = requests.post(
    "https://connect.everugg.net.au/api/v1/shipments/identity-documents",
    headers={"Authorization": "Bearer " + TOKEN, "Idempotency-Key": str(uuid.uuid4())},
    json={
      "front_image": "<front_image>",
      "back_image": "<back_image>"
    },
)
data = r.json()
r.raise_for_status()  # 4xx/5xx: data["error"]["code"] / ["hint"]
```

### Node

```js
const res = await fetch("https://connect.everugg.net.au/api/v1/shipments/identity-documents", {
  method: "POST",
  headers: { Authorization: `Bearer ${TOKEN}`, "Content-Type": "application/json", "Idempotency-Key": crypto.randomUUID() },
  body: JSON.stringify({
    "front_image": "<front_image>",
    "back_image": "<back_image>"
  }),
})
const data = await res.json()
if (!res.ok) throw new Error(`${data.error?.code}: ${data.error?.message}`)
```

### Java

```java
HttpRequest req = HttpRequest.newBuilder()
    .uri(URI.create("https://connect.everugg.net.au/api/v1/shipments/identity-documents"))
    .header("Authorization", "Bearer " + token)
    .header("Content-Type", "application/json")
    .header("Idempotency-Key", UUID.randomUUID().toString())
    .POST(HttpRequest.BodyPublishers.ofString("{ \"front_image\": \"<front_image>\", \"back_image\": \"<back_image>\" }"))
    .build();
HttpResponse<String> res = HttpClient.newHttpClient().send(req, HttpResponse.BodyHandlers.ofString());
```

---
Markdown source: https://connect.everugg.net.au/reference/post-api-v1-shipments-identity-documents.md?lang=en · Web page: https://connect.everugg.net.au/reference?op=post-api-v1-shipments-identity-documents&lang=en