---
title: "Create Attachment Upload Url"
method: POST
path: "/v1/files/upload-url"
tags: ["v1", "protected", "files"]
---

# Create Attachment Upload Url

`POST /v1/files/upload-url`

Mint a presigned PUT for a task attachment uploaded directly to the store.

The client-declared sha256 is bound into the signature as ``ChecksumSHA256``,
so the object store rejects a body that does not hash to it — the upload is
content-verified without the API ever seeing the bytes. The returned ``ref``
is consumed by the task-create endpoint exactly like a server-proxied one.

## Request body

- PresignUploadRequest
  - `content_type` string, required
  - `filename` string, required
  - `sha256` string, required
  - `size` integer, required

## Response `200`

Successful Response

- PresignUploadResponse
  - `expires_in` integer, required
  - `ref` string, required
  - `upload_url` string, required

## Other responses

- `422` — Validation Error

## Changes

> 19 revisions in range; 5 could not be searched.

- **2026-07-28** `d29cbb0c8cc9` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/agentarea/apis/agentarea-api/changes/v1/files/upload-url/post.md)

---

[API](https://skmtc.dev/agentarea/apis/agentarea-api.md) · [All operations](https://skmtc.dev/agentarea/apis/agentarea-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/agentarea/agentarea-api/revisions/ac18f7025c00/schema)