# Upload a file (/api/files/create-file)

`POST https://api.comecero.com/api/v1/files`

Adds a file to sell as a download. The body must be `multipart/form-data`: send the file in a part named `file` (up to 200 MB), or send `file_url` for Comecero to fetch it (up to 500 MB live, 200 MB test). A JSON body is refused with `400`. Secret and trusted tokens may call it.

## Parameters

- `show` (query): Comma-separated fields to return; all others are left out. Use dot notation for child fields (`customer.email`). You cannot send `show` and `hide` together (`400`). See [Customizing output](https://docs.comecero.com/docs/basic-concepts/customizing-output).
- `hide` (query): Comma-separated fields to leave out of the response. Use dot notation for child fields (`customer.email`). You cannot send `show` and `hide` together (`400`). See [Customizing output](https://docs.comecero.com/docs/basic-concepts/customizing-output).
- `formatted` (query): When `true`, the object also has a `formatted` child with amounts and dates as display text in the shopper's language and currency (for example `$19.99` or `November 7, 2026`). The default is `false`. See [Localized formatting](https://docs.comecero.com/docs/basic-concepts/localized-formatting).

Responses: 201, 400, 401, 403, 413, 422, 500.

Full schemas: operation `create_file` in /openapi.json.