> ## Documentation Index
> Fetch the complete documentation index at: https://help.abacusdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Start an ingest upload

> Start a Black Hole resumable upload session.

Desktop agent. Returns a resumable GCS session. **Auth0 only** (`ingest:write`). Dedupes on `(org, sha256)`. Allowlist 404; old agent **426**.


## OpenAPI

````yaml POST /api/v2/ingest/uploads/
openapi: 3.1.0
info:
  title: Abacus Docs API
  version: 1.0.0
  description: |
    REST + SSE surface for Abacus Docs on the same host as the web app
    (`https://abacusdocs.com`). Paths are `/api/v2/…`.

    Authenticate with an organisation API key (`sk-abacus-*`) as a Bearer
    token, or an Auth0 access token. Cross-tenant reads return **404**, not
    403. Page-based lists use `?page=` and `?page_size=`.

    Extraction, reprocess, schema tests, and chat turns spend credits.
    See the help centre Credits pages for rates.
  contact:
    name: Abacus Docs
    url: https://abacusdocs.com/contact
servers:
  - url: https://abacusdocs.com
    description: Production (Extract)
security: []
paths:
  /api/v2/ingest/uploads/:
    post:
      tags:
        - v2/ingest
      summary: Register an upload (idempotent on org + sha256)
      description: >-
        Registers one dropped file (CONTRACT §2.2). New or re-issued
        registrations answer 201 with a GCS resumable-session ``upload_url`` the
        agent PUTs the bytes to directly; an already-landed ``(org, sha256)``
        pair answers 200 duplicate with no upload to perform. A FAILED item
        re-registers back to ``PENDING_UPLOAD`` with a fresh session (the
        re-upload path). Requires the ``ingest:write`` scope on an Auth0 bearer
        JWT.
      operationId: v2_ingest_uploads_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UploadRegisterRequestRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UploadDuplicateResponse'
          description: ''
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UploadPendingResponse'
          description: ''
        '400':
          content:
            application/json:
              schema:
                type: object
                additionalProperties: {}
          description: ''
        '403':
          content:
            application/json:
              schema:
                type: object
                additionalProperties: {}
          description: ''
        '404':
          content:
            application/json:
              schema:
                type: object
                additionalProperties: {}
          description: ''
        '413':
          content:
            application/json:
              schema:
                type: object
                additionalProperties: {}
          description: ''
        '426':
          content:
            application/json:
              schema:
                type: object
                additionalProperties: {}
          description: ''
      security:
        - bearerAuth: []
components:
  schemas:
    UploadRegisterRequestRequest:
      type: object
      description: |-
        POST /api/v2/ingest/uploads/ body (CONTRACT §2.2).

        ``agent_id`` is optional in the body; when both it and the
        ``X-Agent-Id`` header are present they must match (the view enforces
        the 400 ``agent_mismatch``).
      properties:
        sha256:
          type: string
          minLength: 1
          description: Lowercase hex SHA-256 of the file bytes — the org-level dedupe key.
          maxLength: 64
          pattern: ^[0-9a-f]{64}$
        size:
          type: integer
          minimum: 1
        filename:
          type: string
          minLength: 1
          maxLength: 500
        folder_path:
          type: string
          default: ''
          maxLength: 1000
        agent_id:
          type: string
          default: ''
          maxLength: 40
      required:
        - filename
        - sha256
        - size
    UploadDuplicateResponse:
      type: object
      description: 200 body when the ``(org, sha256)`` pair already landed — no upload.
      properties:
        status:
          type: string
          description: Always "duplicate".
        item_id:
          type: string
        state:
          type: string
      required:
        - item_id
        - state
        - status
    UploadPendingResponse:
      type: object
      description: 201 body carrying the GCS resumable session the agent PUTs bytes to.
      properties:
        status:
          type: string
          description: Always "pending_upload".
        item_id:
          type: string
        upload_url:
          type: string
        expires_at:
          type: string
          format: date-time
      required:
        - expires_at
        - item_id
        - status
        - upload_url
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >
        Auth0 access token for a signed-in user. Send `Authorization: Bearer
        <token>`.

        The SPA and desktop agent use this. Prefer an organisation API key for

        server-to-server integrations.

````