---
title: "Show the builder a picture (PNG, JPEG, WebP, GIF, AVIF, at most 10 MB) or a document (PDF, CSV, text, at most 8 MB) as the request body. Pictures are downscaled and stripped of metadata; documents keep only their text. Kept for a week, never part of the site; attach it to a message as a context item (reference or document)"
method: POST
path: "/builder/sessions/{sessionId}/references"
tags: ["Builder"]
---

# Show the builder a picture (PNG, JPEG, WebP, GIF, AVIF, at most 10 MB) or a document (PDF, CSV, text, at most 8 MB) as the request body. Pictures are downscaled and stripped of metadata; documents keep only their text. Kept for a week, never part of the site; attach it to a message as a context item (reference or document)

`POST /builder/sessions/{sessionId}/references`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/builder/sessions/{sessionId}/references`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Path parameters

- `sessionId` string, uuid, required

## Query parameters

- `filename` string
- `source` 'upload' | 'annotation'

## Response `201`

Stored

- object
  - `id` string, uuid, required
  - `kind` 'image' | 'document', required
  - `source` 'upload' | 'url' | 'figma' | 'annotation', required
  - `name` string, required
  - `mediaType` string, required
  - `width` integer, nullable, required
  - `height` integer, nullable, required
  - `chars` integer, nullable, required: document: characters of text read from it
  - `sourceUrl` string, nullable, required: url / figma: the address it came from
  - `sizeBytes` integer, required
  - `createdAt` string, required: ISO-8601 timestamp
  - `expiresAt` string, required: Deleted after this (references are kept for a week)

## Other responses

- `400`: Invalid request (code invalid_request; details.reason: unsupported, too_large, unreadable, no_text, reference_gone)
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Authenticated but not permitted (code forbidden; details.reason private_beta or role)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Refused for now (code conflict; details.reason: plan_building, plan_dismissed, plan_empty, refines_used, figma_connect, archived, stale)
- `413`: Too large
- `429`: Too many requests (code rate_limited; details.reason mode_rate, daily_budget, provider_busy); see Retry-After
- `501`: Not available on this server (code not_configured; details.reason capture_off, figma_off, migration_pending)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)