Upload an asset (single-call multipart)
Changed onSingle-call multipart/form-data upload. The platform streams the bytes through its trusted byte-path, dedups by the server-computed hash, and mints the asset record.
The blake3 hash is always computed server-side from the received bytes — a client-declared expected_hash is verified, never trusted. The uploaded asset is referenceable immediately; any content scanning runs in the background and does not block the response.
~100 MB single-request expectation for v1; chunked/resumable large uploads are a deliberate open question.
Request
- Base URL: http://127.0.0.1:8189
- URL: http://127.0.0.1:8189/api/v2/assets
- Auth: one of:
- HTTP bearer
- none
Headers
Client-generated UUID (recommended). Single-use: the first request to present a key is processed; any later request with the same key is rejected 422 idempotency_key_reuse (reject-on-duplicate, no response replay). Keys expire after 24h.
Response
Bytes deduped to an existing blob; asset minted over it.
Example response
{
"id": "9f8a1c0d-2b3e-4f56-8a7b-1c2d3e4f5a6b",
"hash": "blake3:9f8a1c0d...",
"size_bytes": 4816293,
"content_type": "image/png",
"file_path": "photo.png"
}Changes
- info
added the new optional request property
- info
added the optional property
to the response with the status - info
added the optional property
to the response with the status - info
added the optional property
to the response with the status - info
added the optional property
to the response with the status
- info
- breaking
removed the success response with the status
- breaking