---
title: "Create constrained upload instructions"
method: POST
path: "/uploads"
tags: ["Media"]
---

# Create constrained upload instructions

`POST /uploads`

## Request

- Base URL: `https://api.aisle.wedding/v1`
- URL: `https://api.aisle.wedding/v1/uploads`
- Auth: HTTP bearer

Request a short-lived image upload token through your own same-origin server proxy. The proxy adds the server-only Aisle bearer key when forwarding this request. Never embed that key in client JavaScript. In the browser, build `const pathname = 'weddings/photos/' + wedding.data.id + '/api/' + file.name` and call `upload(pathname, file, { access: 'public', handleUploadUrl: '/api/aisle-upload' })`; use the corresponding `weddings/site/cover/` prefix for a cover. Here `wedding.data.id` is the public ID returned by `GET /wedding`. After upload, register the URL with `POST /photos` or `PATCH /site/cover`. The signed provider callback is internal to Aisle.

## Request body

- object
  - `type` 'blob.generate-client-token', required
  - `payload` object, required
    - `pathname` string, required: Use weddings/photos/{public_wedding_id}/api/ for photos or weddings/site/cover/{public_wedding_id}/api/ for a cover. Substitute the public ID returned by GET /wedding in data.id.
    - `multipart` boolean, required
    - `clientPayload` string, nullable, required

## Response `200`

The requested data.

- PublicUploadInstructions: Return clientToken from your same-origin server proxy to @vercel/blob/client. The proxy, never browser JavaScript, adds the Aisle bearer API key when forwarding the token request. Register the uploaded URL with POST /photos or PATCH /site/cover.
  - `type` 'blob.generate-client-token', required
  - `clientToken` string, required

## Other responses

- `400`: The request itself could not be read, such as a body that is not a JSON object. A field we refuse is validation_failed instead.
- `401`: The API key is missing, malformed, or no longer valid.
- `402`: The operation requires an active Aisle membership for this wedding.
- `403`: The key is valid but not permitted to do this.
- `404`: No such resource inside the key's wedding.
- `405`: That HTTP method is not supported here. See the Allow header.
- `409`: The request collided with the current state of the resource.
- `415`: A request body must be sent as application/json.
- `422`: The request was well-formed but a field was not acceptable. Every field at fault is named in error.details.
- `429`: Too many requests. Retry after the time given in Retry-After.
- `500`: Something went wrong on our side.

---

[API](https://skmtc.dev/aisle/apis/aisle-api.md) · [All operations](https://skmtc.dev/aisle/apis/aisle-api/llms.txt) · [OpenAPI document](https://skmtc.dev/aisle/apis/aisle-api/revisions/689a2f2420cc?raw)