POST /forms/sample HTTP/1.1
Host: example.invalid
Content-Type: multipart/form-data; boundary=----NovusSampleBoundary7MA4YWxkTrZu0gW
Content-Length: 1200

------NovusSampleBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="claim_ref"

CLM-SAMPLE-88
------NovusSampleBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="incident_date"

2026-02-11
------NovusSampleBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="narrative"

A fictional incident recorded for the sample claim fixture.
It runs to two lines, so the parser has to respect the boundary rather than the newline.
------NovusSampleBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="photo_evidence"; filename="sample-photo.png"
Content-Type: image/png

[13 bytes of placeholder text stand in for the PNG payload]
------NovusSampleBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="receipt"; filename="sample receipt (1).pdf"
Content-Type: application/pdf

[placeholder text stands in for the PDF payload]
------NovusSampleBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="declarations"

accurate
------NovusSampleBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="declarations"

copies
------NovusSampleBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="website"


------NovusSampleBoundary7MA4YWxkTrZu0gW--

--
SAMPLE request dump for upload-multipart-encoding.html. The host is example.invalid, both file
parts carry placeholder text instead of real bytes, and nothing here was ever sent anywhere.

This file uses LF line endings for legibility; on the wire every boundary line is CRLF-delimited,
which is why the stated length above counts LF bytes and a live request would count more.

Notes for a parser under test:
  * The delimiter on the wire is two hyphens followed by the declared boundary.
  * declarations appears twice and must survive as two values.
  * One filename contains a space and parentheses, which is legal and often mishandled.
  * The final part is the empty honeypot, which a genuine submission also leaves empty.