Skip to main content
POST
Register an upload (idempotent on org + sha256)
Desktop agent. Returns a resumable GCS session. Auth0 only (ingest:write). Dedupes on (org, sha256). Allowlist 404; old agent 426.

Authorizations

Authorization
string
header
required

Auth0 access token for a signed-in user. Send Authorization: Bearer <token>. The SPA and desktop agent use this. Prefer an organisation API key for server-to-server integrations.

Body

application/json

POST /api/v2/ingest/uploads/ body (CONTRACT §2.2).

agent_id is optional in the body; when both it and the X-Agent-Id header are present they must match (the view enforces the 400 agent_mismatch).

sha256
string
required

Lowercase hex SHA-256 of the file bytes — the org-level dedupe key.

Required string length: 1 - 64
Pattern: ^[0-9a-f]{64}$
size
integer
required
Required range: x >= 1
filename
string
required
Required string length: 1 - 500
folder_path
string
default:""
Maximum string length: 1000
agent_id
string
default:""
Maximum string length: 40

Response

200 body when the (org, sha256) pair already landed — no upload.

status
string
required

Always "duplicate".

item_id
string
required
state
string
required