---
title: "POST /api/rpc/createFileUpload"
method: POST
path: "/api/rpc/createFileUpload"
tags: ["public"]
---

# POST /api/rpc/createFileUpload

`POST /api/rpc/createFileUpload`

## Request

- Base URL: `https://21risk.com`
- URL: `https://21risk.com/api/rpc/createFileUpload`
- Auth: OAuth 2 (client credentials, token URL `/api/v1/oauth/token`)

Upload a local file to 21RISK from a client that can run shell commands, such as Claude Code. Pass the file name, its type and its exact size in bytes (`wc -c < <file>`). Save the returned `uploadScript` to a file and run `sh <script> <path-to-file>` before `expiresAt`. It sends the file in one request, or in parts when it is larger than `partSize`, so files up to 2 GB work. Then call confirmFileUpload with `fileId`: it checks the file and makes it available. Only a confirmed file id works where functions take one, for example `fileId` on createEngineeringReport. Prefer this over uploadAssetFromBase64, which carries the file inside the request and only suits small files.

## Request body

- object
  - `tenant` unknown, required
  - `filename` string, required: The file name, with its extension.
  - `contentType` string, required: The file type, such as image/png or application/pdf.
  - `size` integer, required: The exact size of the file in bytes. The upload must match it.
  - `scope` 'tenant' | 'user', required: Whose the file is: the tenant's (the default), or `user` for your own profile picture. A user's file must be an image, belongs to no tenant and shows wherever you appear.

## Response `200`

Successful response

- object
  - `fileId` string, required: The file id. Confirm the upload with confirmFileUpload, then pass it to functions that take a file id.
  - `contentType` string, required
  - `size` number, required
  - `partSize` number, required: Files larger than this go up in parts of this size.
  - `partCount` number, required: How many parts the file goes up in; 1 for a single PUT.
  - `uploadScript` string, required: A shell script that uploads the file, in one request or in parts. Save it to a file and run `sh <script> <path-to-file>`; it needs only curl, dd and sed.
  - `uploadUrl` string, required: For clients without the script: PUT the whole file here when it fits in one part.
  - `partsUrl` string, required: For clients without the script: the base of the multipart requests for larger files (POST to start, PUT /<n>?upload=<uploadId> per part, POST /complete?upload=<uploadId> with the parts).
  - `expiresAt` string, date-time, required: Every request of the upload must be made before this time.

---

[API](https://skmtc.dev/21risk/apis/21risk-api.md) · [All operations](https://skmtc.dev/21risk/apis/21risk-api/llms.txt) · [OpenAPI document](https://skmtc.dev/21risk/apis/21risk-api/revisions/b8a9eff9eb27?raw)