Accept large files without building your own storage layer

How the flow works

End-to-end encryption

You can enable `e2ee_aes_256_gcm`: the client encrypts the file while FastSend stores the encrypted blob and metadata. The decryption key must remain with your product or user and must not be sent to FastSend.

Request example

curl -X POST https://fast-send.ru/partner-api.php?action=partner_create_transfer \
  -H "Authorization: Bearer fs_partner_live_xxx" \
  -H "Content-Type: application/json" \
  --data '{
    "project_key": "prj_your_project_key",
    "external_id": "order-100500",
    "share_mode": "both",
    "sender_email": "noreply@example.com",
    "recipients": [
        "client@example.com"
    ],
    "subject": "Application documents",
    "encryption_mode": "none",
    "files": [
        {
            "client_file_id": "order-100500-contract-v1",
            "filename": "contract.pdf",
            "size": 7340032,
            "content_type": "application/pdf"
        }
    ],
    "metadata": {
        "order_id": 100500
    }
}'

Create response

`uploads` is intentionally empty: call `initialize_endpoint` first. Keep `upload_resume_key` until finalization and never write it to logs.

{
    "ok": true,
    "idempotent": false,
    "transfer": {
        "id": 987,
        "external_id": "order-100500",
        "status": "draft",
        "expires_at": "2027-07-16T12:00:00+03:00"
    },
    "uploads": [],
    "upload_initialization_required": true,
    "upload_requests": [
        {
            "client_file_id": "order-100500-contract-v1",
            "upload_type": "single",
            "initialize_endpoint": "partner-api.php?action=partner_create_upload_url",
            "filename": "contract.pdf",
            "relative_path": "contract.pdf",
            "content_type": "application/pdf",
            "size": 7340032,
            "confirm_endpoint": "partner-api.php?action=partner_confirm_upload"
        }
    ],
    "upload_resume_key": "<43-char-scoped-secret>",
    "upload_resume_key_revealed_once": false,
    "upload_resume_key_recoverable_on_idempotent_replay": true,
    "upload_resume_expires_at": "2026-07-17 12:00:00",
    "management_access_code": "<management-secret>",
    "management_access_code_revealed_once": false,
    "management_access_code_recoverable_on_idempotent_replay": true
}

Initialize a single file

curl -X POST https://fast-send.ru/partner-api.php?action=partner_create_upload_url \
  -H "Authorization: Bearer fs_partner_live_xxx" \
  -H "Content-Type: application/json" \
  --data '{
    "project_key": "prj_your_project_key",
    "send_id": 987,
    "upload_resume_key": "<43-char-scoped-secret>",
    "client_file_id": "order-100500-contract-v1",
    "filename": "contract.pdf",
    "relative_path": "contract.pdf",
    "content_type": "application/pdf",
    "size": 7340032
}'

Then PUT the bytes to `upload_url` with the same `Content-Type` and call `partner_confirm_upload` with `project_key`, `send_id`, `upload_resume_key` and `upload_id`. For multipart, request each part URL, retain its ETag and pass the ordered `parts` array to `partner_complete_multipart_upload`.

Webhook

FastSend sends `transfer.finalized`, `transfer.downloaded`, `transfer.file_deleted` and `transfer.deleted`. `X-FastSend-Signature: sha256=…` is an HMAC-SHA256 over the exact byte sequence `X-FastSend-Timestamp + "." + raw_body`. The receiver rejects timestamps older than five minutes, compares the signature in constant time and deduplicates `X-FastSend-Delivery`.

{
    "event": "transfer.finalized",
    "partner_id": 12,
    "project_id": 34,
    "transfer": {
        "id": 987,
        "external_id": "order-100500",
        "share_url": "https://fast-send.ru/?t=abc123",
        "status": "sent",
        "declared_size": 7340032,
        "file_count": 1,
        "encryption_mode": "e2ee_aes_256_gcm"
    },
    "data": {
        "email_delivery": {
            "sent": 1,
            "failed": 0
        }
    },
    "occurred_at": "2026-10-13T22:44:32+03:00"
}

Test vector
secret: whsec_test_0123456789abcdef
timestamp: 1720000000
payload: {"event":"transfer.finalized","transfer":{"id":987}}
signature: sha256=993d8c2f1f8322474acdd42154dbafd815d5e2a0cb3ccef2b26f64bbfcbe6830

Direct file download

When a partner needs to deliver a file inside its own interface without the FastSend download page, the backend requests a signed link. The link contains no API key, expires automatically and still counts actual outbound traffic.

curl -X POST https://fast-send.ru/partner-api.php?action=partner_create_direct_download_link \
  -H "Authorization: Bearer FS-PARTNER-..." \
  -H "Content-Type: application/json" \
  --data '{
    "project_key": "prj_your_project_key",
    "external_id": "order-100500",
    "file_id": 123,
    "ttl_seconds": 604800
}'

Project management

POST /partner-api.php?action=partner_update_project
Authorization: Bearer FS-PARTNER-...
Content-Type: application/json

{
  "project_key": "prj_your_project_key",
  "name": "CRM production",
  "domain": "crm.example.com",
  "allowed_origins": "https://crm.example.com",
  "webhook_url": "https://crm.example.com/webhooks/fastsend",
  "rotate_webhook_secret": true,
  "e2e_enabled": true,
  "status": "active"
}