Secure Data Exchange File Upload API API
| REST | |
| Version 1.0 - beta | |
| 17 March 2026 | |
| Sandbox base URL | https://test-api.service.hmrc.gov.uk |
| Production base URL | https://api.service.hmrc.gov.uk |
Overview
An API for creating URLs that can be used to upload one or more files and associated metadata to the Secure Data Exchange Service (SDES). The API is designed for use with Web Forms.
Errors
We use standard HTTP status codes to show whether an API request succeeded or not. They are usually in the range:
- 200 to 299 if it succeeded, including code 202 if it was accepted by an API that needs to wait for further action
- 400 to 499 if it failed because of a client error by your application
- 500 to 599 if it failed because of an error on our server
Errors specific to each API are shown in the Endpoints section, under Response. See our reference guide for more on errors.
Testing
You can use the HMRC Developer Sandbox to test the API. The Sandbox is an enhanced testing service that functions as a simulator of HMRC’s production environment.
Test Data
The following test data is pre-configured to use in the sandbox environment.
Scenario 01 - 201 Created
Generate a 201 Created response to test the successful generation of file upload urls. This scenario will produce an upload URL from a set of valid UUIDs so you will still get some repeated URLs. You can use any filename.
- Request parameters
-
- SRN
012345678901- informationType
informationType901
- Request URL
/misc/sdes-file-upload/files/upload/url/012345678901/informationType901- Request payload
-
[ { "filename": "testfile1.csv" } ] - Request payload with metadata
-
[ { "filename": "testfile1.csv", "metadata": [ { "key": "keyText1", "value": "valueText1" } ] } ]
Scenario 02 - 400 Bad Request
Generate a 400 Bad Request response to test the error condition
- Request parameters
-
- SRN
456701238998- informationType
informationType998
- Request URL
/misc/sdes-file-upload/files/upload/url/456701238998/informationType998- Request payload
-
[ { "filename": "testfile2.pdf", "metadata": [ { "key": "keyText2" } ] } ]
Scenario 03 - 403 Forbidden
Generate a 403 Forbidden response to test for invalid credentials
- Request parameters
-
- SRN
789701238789- informationType
informationType789
- Request URL
/misc/sdes-file-upload/files/upload/url/789701238789/informationType789- Request payload
-
[ { "filename": "testfile3.txt", "metadata": [ { "key": "keyText3", "value": "valueText3" } ] } ]
Scenario 04 - 410 Gone
Generate a 410 Gone response to test for expired URLs. The URL produced will always result in the 410 response. You do not need to wait for 30 minutes. You can use any filename.
- Request parameters
-
- SRN
456701238998- informationType
informationType998
- Request URL
/misc/sdes-file-upload/files/upload/url/456701238998/informationType998- Request payload
-
[ { "filename": "testfile3.txt", "metadata": [ { "key": "keyText3", "value": "valueText3" } ] } ]
Versioning
When an API changes in a way that is backwards-incompatible, we increase the version number of the API. See our reference guide for more on versioning.
Endpoints
| Version | Environments | Endpoints |
|---|---|---|
|
Version 1.0 - beta
(opens in new tab) |
Sandbox and Production | 1.0 endpoints |