---
title: "Reserve an Asset and mint an upload URL"
method: POST
path: "/assets/uploads"
tags: ["Assets"]
---

# Reserve an Asset and mint an upload URL

`POST /assets/uploads`

## Request

- Base URL: `https://api.adcrunch.dev`
- URL: `https://api.adcrunch.dev/assets/uploads`
- Auth: HTTP bearer

Reserves an Asset and returns a presigned `PUT` URL to upload the bytes to. The URL is valid for one hour, and `expiresAt` says when it stops being accepted.

The client uploads **directly** to storage — the bytes never pass through this worker, because Cloudflare rejects over-limit request bodies at the proxy before any code runs. Call `POST /assets/{id}/finalize` once the upload completes.

The URL is the credential: anyone holding it can write that one key until it expires. Nothing is known about the file until finalize inspects what actually landed, so size and type cannot be enforced here.

The reserved Asset stays `pending` until finalize. No read, rename or list answers a `pending` Asset, and a reservation nobody finalizes is swept a day later, together with whatever landed under it.

## Request body

- object
  - `filename` string, required: The name of the file you are about to send. Shown until somebody renames the Asset, and never used to look one up.

## Response `200`

The reservation. Send the bytes to `uploadUrl`, then finalize `assetId`.

- object
  - `assetId` string, required: The Asset this reservation made. Finalize it with this id.
  - `expiresAt` number, required: When the upload URL stops being accepted, in milliseconds since the Unix epoch, UTC.
  - `uploadUrl` string, required: PUT the bytes here, directly. The URL is the credential: anybody holding it can write that one object until it expires.

## Other responses

- `400`: The request does not match the schema of this operation: a field is missing or has the wrong type, or the body is not valid JSON. `error` is `invalid_request`, and `issues` names each field. Nothing was changed.
- `401`: No API key, or one that does not resolve. See the security scheme. `error` is `unauthorized`.
- `402`: The organization has no active subscription. An owner subscribes at `paywallUrl`. `error` is `organization_unentitled`.
- `403`: The caller does not hold `asset:write`. `error` is `forbidden`.
- `500`: AdCrunch could not write the reservation. `error` is `reservation_failed`. Nothing was reserved, so send the request again.

---

[API](https://skmtc.dev/adcrunch/apis/adcrunch-api.md) · [All operations](https://skmtc.dev/adcrunch/apis/adcrunch-api/llms.txt) · [OpenAPI document](https://skmtc.dev/adcrunch/apis/adcrunch-api/revisions/a420ba80914f?raw)