uploads
Tenant-scoped immutable upload lifecycle.
| Method | Path | Operation ID |
|---|---|---|
| POST | /v1/uploads |
createUpload |
| POST | /v1/uploads/{upload_id}/abort |
abortUpload |
| POST | /v1/uploads/{upload_id}/complete |
completeUpload |
POST /v1/uploads
Section titled “POST /v1/uploads”Operation ID: createUpload
Create an expiring tenant-scoped direct upload session.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Request body
Section titled “Request body”application/json: CreateUploadRequest (required)
| Field | Type | Required | Description |
|---|---|---|---|
byte_length |
integer | yes | |
declared_media_type |
string | yes | Pattern: ^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*$. Max length 127. |
filename |
string or null | no | |
mode |
UploadMode | yes | One of: single, multipart. |
parts |
array of MultipartPartRequest | no | Default []. |
sha256 |
string | yes | Pattern: ^[0-9a-fA-F]{64}$. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 201 | Successful Response | application/json CreateUploadResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. | application/json HttpErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
201 response fields
Section titled “201 response fields”| Field | Type | Required | Description |
|---|---|---|---|
asset_id |
string | yes | |
expires_at |
string | yes | |
mode |
UploadMode | yes | One of: single, multipart. |
parts |
array of PresignedPartResponse | no | Default []. |
status |
UploadStatus | yes | One of: initiated, completed, aborted, expired. |
upload |
PresignedRequestResponse or null | no | |
upload_id |
string | yes |
POST /v1/uploads/{upload_id}/abort
Section titled “POST /v1/uploads/{upload_id}/abort”Operation ID: abortUpload
Abort an initiated upload and remove its exact staging capability.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
upload_id |
path | string | yes | Pattern: ^upl_[a-z2-7]{16}$. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json AbortUploadResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
status |
UploadStatus | yes | One of: initiated, completed, aborted, expired. |
upload_id |
string | yes |
POST /v1/uploads/{upload_id}/complete
Section titled “POST /v1/uploads/{upload_id}/complete”Operation ID: completeUpload
Verify and conditionally pin the exact immutable object.
Authentication: Authorization: Bearer <API key or console session> (Authentication).
Parameters
Section titled “Parameters”| Name | In | Type | Required | Description |
|---|---|---|---|---|
upload_id |
path | string | yes | Pattern: ^upl_[a-z2-7]{16}$. |
Idempotency-Key |
header | string | yes | Pattern: ^[!-~]+$. Max length 200. |
Request body
Section titled “Request body”application/json: CompleteUploadRequest (required)
| Field | Type | Required | Description |
|---|---|---|---|
parts |
array of CompletePartRequest | no | Default []. |
Responses
Section titled “Responses”| Status | Description | Body |
|---|---|---|
| 200 | Successful Response | application/json CompleteUploadResponse |
| 401 | The bearer credential is missing, malformed, expired, revoked, or otherwise invalid. Clerk sessions and scoped API keys fail identically and the body never reveals which credential was presented or whether it exists. | application/json HttpErrorResponse |
| 403 | The provider deleted this identity, or the account is deactivated. A valid session cannot authorize a tombstoned identity back into use; an API key must also grant the scope required by the operation, and an operation is not classified by the route/scope policy and is denied by default. An API key restricted to client networks is refused from any other network with the API_KEY_IP_NOT_ALLOWED envelope. |
application/json HttpErrorResponse or ErrorResponse |
| 404 | Not Found | application/json ErrorResponse |
| 409 | Just-in-time provisioning conflicted: the verified email belongs to another provisioned account. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 410 | Gone | application/json ErrorResponse |
| 422 | A verified email is unavailable for account provisioning. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
| 429 | The API key’s own request rate limit was exceeded (API_KEY_RATE_LIMITED). Only keys configured with a rate limit can receive this. Retryable after Retry-After seconds; the refused request consumed no capacity. |
application/json ErrorResponse |
| 503 | Credential verification is unavailable: Clerk session verification is not configured, no API-key pepper is enrolled, or bounded API-key verification is temporarily overloaded. Retryable. This operation may also return its reason-coded domain envelope with this status. | application/json HttpErrorResponse or ErrorResponse |
200 response fields
Section titled “200 response fields”| Field | Type | Required | Description |
|---|---|---|---|
asset_id |
string | yes | |
asset_object_id |
string | yes | |
byte_length |
integer | yes | |
sha256 |
string | yes | |
status |
UploadStatus | yes | One of: initiated, completed, aborted, expired. |
upload_id |
string | yes |