---
title: "Upload a file"
method: POST
path: "/code/files"
---

# Upload a file

`POST /code/files`

## Request

- Base URL: `https://api.caveman.so/api/v1`
- URL: `https://api.caveman.so/api/v1/code/files`
- Auth: one of:
  - OAuth 2
    - Authorization code: `/api/v1/oauth/authorize`
    - Token URL: `/api/v1/oauth/token` scopes: `code:write`
  - HTTP bearer
  - API key in cookie `cave_access`
  - API key in cookie `__Secure-cave_identity.session_token`

POST /api/v1/code/files on the Caveman Cloud control plane. Requires the code:write scope. Not exposed to autonomous agents: Caveman Code files are the org's inputs for sessions and the outputs sessions wrote, uploaded and read through the Agents API by a person or a service account's key. An agent in a session reads its attached files at /mnt/session/uploads and writes /mnt/session/outputs through its runtime, never through a control-plane connection.

## Request body `multipart/form-data`

- object
  - `file` string, binary, required

## Response `201`

The file

- CodeFile
  - `id` string, uuid, required
  - `name` string, required: One path segment; an input mounts at /mnt/session/uploads/<name>.
  - `media_type` string, required
  - `size_bytes` integer, required
  - `sha256` string, required
  - `purpose` 'input' | 'output', required: input: uploaded for sessions to read; output: a session wrote it under /mnt/session/outputs/.
  - `session_id` string, uuid
  - `workspace_id` string, uuid
  - `path` string: An output's path under /mnt/session/outputs/.
  - `created_by_user_id` string, uuid
  - `created_by_service_account_id` string, uuid
  - `created_at` string, date-time, required

## Other responses

- `401`: A person's sign-in or a code:run key is required.
- `403`: The role, the key's scope, or an inactive service account (cave_code_service_account_inactive) refuses.
- `413`: Over 100 MB (cave_code_file_too_large).
- `2XX`: Successful response. Exact status depends on synchronous or durable delivery outcome.
- `4XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `5XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.

---

[API](https://skmtc.dev/caveman/apis/caveman-cloud-api.md) - [All operations](https://skmtc.dev/caveman/apis/caveman-cloud-api/llms.txt) - [OpenAPI document](https://skmtc.dev/caveman/apis/caveman-cloud-api/revisions/508312d01cfc?raw)