---
title: "Create secure"
method: POST
path: "/v2/files/secure"
tags: ["Files"]
---

# Create secure

`POST /v2/files/secure`

## Request

- Base URL: `https://api.chat.ethora.com`
- URL: `https://api.chat.ethora.com/v2/files/secure`
- Auth: HTTP bearer

**Auth**: User JWT

Secure chat-attachment upload (v2). Stores the file in the private
secure bucket and binds it to a chat (`roomName`). Downloads are then
gated per-fetch by chat membership and served from the secure files
domain, so the returned `location` points at `secure-files.<domain>`
(fetch it with the `fileToken` cookie on web, or `?ft=<fileToken>` on
native/embedded clients). The caller must be a member of `chatName`.
On a server without a secure files host the route answers
`503 SECURE_FILES_DISABLED`; upload through `POST /v1/files` instead
(the public files bucket).

## Response `200`

```
{
  success: boolean,
  results: [{
    userId: string,
    ownerKey: string,
    location: string,          // https://secure-files.<domain>/<bucket>/<key>
    locationPreview?: string,
    originalname: string,
    filename: string,
    mimetype: string,
    size: number,
    objectKey: string,
    roomName: string,          // the chat the file is bound to
    clientEncrypted: boolean,  // bytes are client-side ciphertext
    _id: string,
    createdAt: string,
    updatedAt: string,
  }],
}
```

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: The caller is not a member of `chatName`.
- `404`: Not Found
- `422`: `chatName` is missing, or no files were provided.
- `500`: Internal server error

---

[API](https://skmtc.dev/ethora/apis/platform-api.md) · [All operations](https://skmtc.dev/ethora/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ethora/apis/platform-api/revisions/01b6e64378ee?raw)