diff --git a/lib/api/draft_notes.rb b/lib/api/draft_notes.rb
index 3d046ec4a9bae634676fe6cde8a9b9e13fc87aa2..6a20979269ef33b06319b54e6e5de7c2cc82da75 100644
--- a/lib/api/draft_notes.rb
+++ b/lib/api/draft_notes.rb
@@ -52,7 +52,7 @@ def authorize_admin_draft!(draft_note)
           requires :base_sha, type: String, desc: 'Base commit SHA in the source branch'
           requires :start_sha, type: String, desc: 'SHA referencing commit in target branch'
           requires :head_sha, type: String, desc: 'SHA referencing HEAD of this merge request'
-          requires :position_type, type: String, desc: 'Type of the position reference', values: %w[text image]
+          requires :position_type, type: String, desc: 'Type of the position reference', values: %w[text image file]
           optional :new_path, type: String, desc: 'File path after change'
           optional :new_line, type: Integer, desc: 'Line number after change'
           optional :old_path, type: String, desc: 'File path before change'
diff --git a/spec/requests/api/draft_notes_spec.rb b/spec/requests/api/draft_notes_spec.rb
index b9654bff174390622d7acb93be497c89d5af8128..be3ece0a1960819c6fe2c1d726d01a2ecc0e27bb 100644
--- a/spec/requests/api/draft_notes_spec.rb
+++ b/spec/requests/api/draft_notes_spec.rb
@@ -203,6 +203,19 @@ def create_draft_note(params = {}, url = base_url)
         end
       end
 
+      context "when using a diff file position" do
+        let!(:draft_note) { create(:draft_note_on_text_diff, merge_request: merge_request, author: user) }
+
+        it "creates a new diff file draft note" do
+          position = draft_note.position.to_h.merge(position_type: 'file').except(:ignore_whitespace_change)
+
+          post api("/projects/#{project.id}/merge_requests/#{merge_request['iid']}/draft_notes", user),
+            params: { note: 'hi!', position: position }
+
+          expect(response).to have_gitlab_http_status(:created)
+        end
+      end
+
       context "when attempting to resolve a disscussion" do
         context "when providing a non-existant ID" do
           it "returns a 400 Bad Request" do