---
title: "Get a link to upload files from your disk"
method: POST
path: "/v1/sites/{site_id}/images/upload-link"
tags: ["Images"]
---

# Get a link to upload files from your disk

`POST /v1/sites/{site_id}/images/upload-link`

## Request

- Base URL: `https://api.getsitecontrol.com`
- URL: `https://api.getsitecontrol.com/v1/sites/{site_id}/images/upload-link`
- Auth: HTTP bearer

A link to add files from your disk to the site's image library without
encoding them. PUT the file's bytes to `url` as the request body, no
authorization header, from any HTTP client; the answer is status 201 with the
stored image, the same `id`, `url`, `width` and `height` that `upload_image`
returns. The link works for an hour and takes any number of files, one after
another: every PUT adds a new image. The file's type is read from its bytes; a
file is at most 3 MB, images of any common format are accepted. With a public
address use `upload_image` with `url`; a file on your disk goes here rather
than into `data`.

## Path parameters

- `site_id` integer, required

## Headers

- `Idempotency-Key` string: Makes a retry of a POST safe: a repeat with the same key, body and GSC-Version returns the stored response with `Idempotency-Replayed: true` instead of running again. The key protects against repeated execution while the key store works. Saving the change and storing the response under the key are not atomic: if the process or the key store fails between them, the change is kept, the key is released after 15 minutes and a retry runs the request again. After a timeout or a 5xx, read the resource to check the result before retrying. 5xx and 429 responses and responses over 256 KB are not stored, so a repeat runs the request again. A key is kept for 24 hours. The same key with another body or version is 422; a repeat while the first request runs is 409.

## Response `201`

Successful Response

- ImageUploadLink
  - `url` string, required: PUT a file's bytes here as the request body, no authorization header; each PUT stores one more image and answers with it
  - `expires_at` string, date-time, required: When the link stops working, an hour after it was made

## Other responses

- `400`: Unsupported GSC-Version
- `401`: Missing or invalid API key or access token
- `403`: Access denied
- `404`: Not found
- `409`: Conflict
- `413`: Request body too large
- `422`: Validation failed
- `429`: Rate limited
- `503`: Temporarily unavailable; retry later

---

[API](https://skmtc.dev/getsitecontrol/apis/getsitecontrol-public-api.md) - [All operations](https://skmtc.dev/getsitecontrol/apis/getsitecontrol-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getsitecontrol/apis/getsitecontrol-public-api/revisions/084fcad80e75?raw)