curl --request POST \
--url https://partners-api.sandbox.securitize.io/investors/v1/onboarding-reliance/investors/{investorId}/tax-forms \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: multipart/form-data' \
--form formType=W-9 \
--form signatureDate=2026-10-20 \
--form 'file=@example-file;type=application/pdf'{
"taxFormId": "b68db8ed-8424-4d54-99ed-34c0a3cb826c",
"formType": "W-9",
"submittedAt": "2026-10-20T17:19:50.730Z"
}Upload an investor's signed tax form
Sends Securitize the tax form the investor signed, as a PDF, so it is on file for the withholding on the investor’s distributions. One form per call, as multipart/form-data: the PDF in the file part, and formType and signatureDate as text parts. A JSON body is refused.
Checks, in order — each one stops the request, and nothing is kept:
- the investor resolves in your account — else
404 investor_not_found; - the file is at most 10 MB, and there is only one, in the
filepart — else413 payload_too_largeor400 validation_error; - the body is
multipart/form-data, with the boundary your HTTP client generated, andformTypeandsignatureDateare valid — else415 mime_not_supportedor400 validation_error; - you lead the investor’s verification — else
409 investor_not_owned; - the form applies to the investor’s type:
W-9orW-8BENfor an individual,W-9orW-8BEN-Efor an entity — else422 tax_form_type_not_allowed, withdetails.allowed; - the
filepart is present and is a PDF, judged by its first bytes — else400 validation_erroror415 mime_not_supported.
The form can be sent at any point of the investor’s verification, before or after it is verified.
An investor has one tax form on file. A new upload replaces the form on file, whatever its type, so sending the same form again is safe. The answer is a receipt: there is no call to read or list an investor’s tax forms.
In sandbox, any PDF of at most 10 MB works as a test file.
curl --request POST \
--url https://partners-api.sandbox.securitize.io/investors/v1/onboarding-reliance/investors/{investorId}/tax-forms \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: multipart/form-data' \
--form formType=W-9 \
--form signatureDate=2026-10-20 \
--form 'file=@example-file;type=application/pdf'{
"taxFormId": "b68db8ed-8424-4d54-99ed-34c0a3cb826c",
"formType": "W-9",
"submittedAt": "2026-10-20T17:19:50.730Z"
}Authorizations
OAuth 2.0 client credentials. Exchange the client id and secret Securitize issued you for a bearer token at the token URL (the host root, not under the base URL), with grant_type=client_credentials; the token lasts 2 hours and goes in the Authorization: Bearer header of every request. No scope is needed. The token identifies your partner account, so you never send a partner id, and every record you create is scoped to you.
Path Parameters
Body
The parts of the multipart/form-data body.
The date the investor signed the form, as YYYY-MM-DD. At most one day after today in UTC, so a form signed today in any time zone is accepted. For a W-8BEN or W-8BEN-E it sets when the form expires: on December 31 of the third year after the year it was signed. A W-8 signed so long ago that this date has passed is accepted, but it is out of date: send a newly signed one.
"2026-10-20"
Response
The form is on file for the investor, replacing any earlier one.
The receipt for a tax form now on file for the investor.