---
title: "Upload compliance certificate"
method: POST
path: "/v1/trust-portal/compliance-resources/upload"
tags: ["Trust Portal"]
---

# Upload compliance certificate

`POST /v1/trust-portal/compliance-resources/upload`

Upload or replace a compliance certificate PDF such as SOC 2, ISO 27001, HIPAA, or GDPR evidence for Trust Center sharing.

## Request body

- UploadComplianceResourceDto
  - `organizationId` string, required — Organization ID that owns the compliance resource
  - `framework` 'iso_27001' | 'iso_42001' | 'gdpr' | 'hipaa' | 'soc2_type1' | 'soc2_type2' | 'soc3' | 'pci_dss' | 'nen_7510' | 'iso_9001' | 'pipeda' | 'ccpa' — Native compliance framework identifier
  - `customFrameworkId` string — Org-authored custom framework ID (alternative to `framework`)
  - `fileName` string, required — Original file name (PDF only)
  - `fileType` string, required — MIME type of the file
  - `fileData` string, required — Base64 encoded PDF content

## Response `201`

Compliance certificate uploaded successfully

- ComplianceResourceResponseDto
  - `framework` 'iso_27001' | 'iso_42001' | 'gdpr' | 'hipaa' | 'soc2_type1' | 'soc2_type2' | 'soc3' | 'pci_dss' | 'nen_7510' | 'iso_9001' | 'pipeda' | 'ccpa', nullable, required — Set for native-framework certificates; null for custom ones
  - `customFrameworkId` object, nullable, required — Set for custom-framework certificates; null for native ones
  - `fileName` string, required
  - `fileSize` number, required — File size in bytes
  - `updatedAt` string, required — ISO timestamp when the certificate was last updated

## Other responses

- `400` — Framework not compliant, PDF validation failed, or organization mismatch

---

[API](https://skmtc.net/trycompai/apis/comp-ai-api.md) · [All operations](https://skmtc.net/trycompai/apis/comp-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/trycompai/comp-ai-api/versions/726b9523fb22/schema)