> ## Documentation Index > Fetch the complete documentation index at: https://docs.maxcare.ai/llms.txt > Use this file to discover all available pages before exploring further. # Attach an insurance card image > Multipart upload of one side of an insurance card, filed against the patient's coverage in the EHR. The vendor mechanics differ and are absorbed here: ModMed fills the POLICY's own card slots (so the coverage must exist first — otherwise 404 `insurance_not_found`), while other EHRs file a typed chart document. Accepts PNG, JPEG, WEBP or HEIC up to 10 MB. The declared content type is treated as a hint only — the BYTES are sniffed, and a mismatch is rejected with 415 `unsupported_media_type`. No durable copy is kept on our side: the bytes are held in memory for the request, pushed to the EHR, and dropped. Nothing is written to storage, and the request body is not logged. Because there is no stored copy there is also NO RETRY on our side — if the attachment fails, re-upload. The platform does NOT strip EXIF metadata or run malware scanning — a phone photo can carry GPS coordinates, so do both before uploading. ## OpenAPI ````yaml /openapi-v2.json post /patients/{id}/insurance/cards openapi: 3.0.0 info: title: Max AI Public API description: API for third-party marketplace apps version: '2.0' contact: {} servers: - url: https://api.maxcare.ai/v2 security: [] tags: [] paths: /patients/{id}/insurance/cards: post: tags: - Patients summary: Attach an insurance card image description: >- Multipart upload of one side of an insurance card, filed against the patient's coverage in the EHR. The vendor mechanics differ and are absorbed here: ModMed fills the POLICY's own card slots (so the coverage must exist first — otherwise 404 `insurance_not_found`), while other EHRs file a typed chart document. Accepts PNG, JPEG, WEBP or HEIC up to 10 MB. The declared content type is treated as a hint only — the BYTES are sniffed, and a mismatch is rejected with 415 `unsupported_media_type`. No durable copy is kept on our side: the bytes are held in memory for the request, pushed to the EHR, and dropped. Nothing is written to storage, and the request body is not logged. Because there is no stored copy there is also NO RETRY on our side — if the attachment fails, re-upload. The platform does NOT strip EXIF metadata or run malware scanning — a phone photo can carry GPS coordinates, so do both before uploading. operationId: PatientsPublicController_attachInsuranceCard parameters: - name: id required: true in: path description: Patient ID schema: type: string - name: side required: true in: query description: Which side of the card this image is schema: enum: - front - back type: string - name: coverageOrder required: false in: query description: >- 1 = primary (default), 2 = secondary — which coverage the card belongs to schema: {} - name: X-Organization-Id in: header required: true schema: type: string description: Target clinic organization ID requestBody: required: true content: multipart/form-data: schema: type: object required: - file properties: file: type: string format: binary description: One side of the card responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AttachInsuranceCardSuccessResponse' '400': description: Missing or invalid request parameter content: application/json: schema: $ref: '#/components/schemas/PublicApiBadRequestResponse' '401': description: Invalid or missing API key content: application/json: schema: $ref: '#/components/schemas/PublicApiUnauthorizedResponse' '403': description: Insufficient scope content: application/json: schema: $ref: '#/components/schemas/PublicApiForbiddenResponse' '404': description: Resource not found content: application/json: schema: $ref: '#/components/schemas/PublicApiNotFoundResponse' '415': description: Unsupported media type content: application/json: schema: $ref: '#/components/schemas/PublicApiUnsupportedMediaTypeResponse' '429': description: Rate limit exceeded content: application/json: schema: $ref: '#/components/schemas/PublicApiRateLimitResponse' '502': description: EHR sync failed content: application/json: schema: $ref: '#/components/schemas/PublicApiBadGatewayResponse' '503': description: EHR integration unavailable content: application/json: schema: $ref: '#/components/schemas/PublicApiServiceUnavailableResponse' security: - api-key: [] components: schemas: AttachInsuranceCardSuccessResponse: type: object properties: code: type: string description: Response code example: success data: $ref: '#/components/schemas/AttachInsuranceCardData' required: - code - data PublicApiBadRequestResponse: type: object properties: code: type: string description: Error code example: bad_request message: type: string description: Human-readable error message example: '''id'' must be a valid UUID' trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiUnauthorizedResponse: type: object properties: code: type: string description: Error code example: unauthorized message: type: string description: Human-readable error message example: Invalid or missing API key trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiForbiddenResponse: type: object properties: code: type: string description: Error code example: forbidden message: type: string description: Human-readable error message example: Insufficient scope trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiNotFoundResponse: type: object properties: code: type: string description: Error code example: not_found message: type: string description: Human-readable error message example: Resource not found trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiUnsupportedMediaTypeResponse: type: object properties: code: type: string description: Error code example: unsupported_media_type message: type: string description: Human-readable error message example: The uploaded file is not a PNG, JPEG, WEBP or HEIC image trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiRateLimitResponse: type: object properties: code: type: string description: Error code example: rate_limit_exceeded message: type: string description: Human-readable error message example: Rate limit exceeded. Maximum 1000 requests per 60 seconds. trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiBadGatewayResponse: type: object properties: code: type: string description: Error code example: unexpected_integration_error message: type: string description: Human-readable error message example: EHR sync failed trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id PublicApiServiceUnavailableResponse: type: object properties: code: type: string description: Error code example: server_unresponsive message: type: string description: Human-readable error message example: EHR integration is not available for this note trace_id: type: string description: Trace ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 required: - code - message - trace_id AttachInsuranceCardData: type: object properties: patientId: type: string description: Patient the card was filed against example: pat_c56103bcd39c46d39f3138dd2b5e05f6 side: type: string enum: - front - back example: front coverageOrder: type: number description: 1 = primary coverage, 2 = secondary example: 1 externalId: type: string nullable: true description: >- The EHR's own id for the attachment, when the vendor returns one. Null is not a failure — a 2xx means the card is in the chart. example: '884213' required: - patientId - side - coverageOrder - externalId securitySchemes: api-key: scheme: bearer bearerFormat: JWT type: http description: Marketplace API key ````