---
title: "Get an upload URL for each file of a session's input."
method: POST
path: "/o/{org}/files"
tags: ["Attachments"]
---

# Get an upload URL for each file of a session's input.

`POST /o/{org}/files`

## Request

- Base URL: `https://api.prix.dev`
- URL: `https://api.prix.dev/o/{org}/files`
- Auth: HTTP bearer

Name each file and its type, then `PUT` its bytes to the `upload_url` that comes back,
straight to storage and in parallel if you like, with the same `Content-Type` as its
`mime_type`. There is no size field and no size limit here: one `PUT` takes a file up to
5 GB. An `upload_url` is good for an hour. Pass each id as a
`{"type": "file", "source": {"type": "file", "file_id": id}}` block in a session's or a
follow-up's `input`. When the session starts, each file's bytes are checked against its
type and its size is read from storage; a file never uploaded is refused there with
`409 ATTACHMENT_NOT_UPLOADED`. At most 50 files per call. Rate-limited to 30 calls a minute
per caller.

## Request body

- object
  - `files` object[], required
    - `name` string, required: The file name in the sandbox. No `/`, `\`, `..`, leading `.`, or control characters.
    - `mime_type` string, required: The file's media type. Send it as the `Content-Type` of the `PUT`.

## Response `201`

An upload URL per file, in the order asked for.

- object
  - `files` object[], required
    - `id` string, uuid, required
    - `name` string, required
    - `mime_type` string, required
    - `upload_url` string, uri, required: A signed URL to `PUT` the file to, with `Content-Type: <mime_type>`.
    - `upload_expires_at` string, date-time, required

## Other responses

- `400`: Not the JSON shape above, a `multipart/form-data` body or a `size` field (`INVALID_BODY`, naming the shape), an invalid name or type, or more than 50 files (`TOO_MANY_FILES`).
- `401`: No bearer, an unknown, revoked or expired one, or an API key on a route keys cannot call.
- `404`: No such resource for the caller, including one in an org the caller is not in or a Project that is private to someone else.
- `429`: Upload rate limit exceeded. `Retry-After` is set.

---

[API](https://skmtc.dev/getrush/apis/rush-api.md) · [All operations](https://skmtc.dev/getrush/apis/rush-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getrush/apis/rush-api/revisions/e351f947926b?raw)