---
title: "Get a drop link and the files the user uploaded"
method: GET
path: "/sites/drops/{id}"
tags: ["Sites"]
---

# Get a drop link and the files the user uploaded

`GET /sites/drops/{id}`

## Request

- Base URL: `https://api.hypamoon.com/api/v1`
- URL: `https://api.hypamoon.com/api/v1/sites/drops/{id}`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://app.hypamoon.com/oauth/authorize`, token URL `https://api.hypamoon.com/oauth/token`, scopes: `sites:read`)

status is open (waiting for the user), done (the user pressed Done) or expired (after 24 hours). files lists what arrived (photos with variant 2048 or 640, width and height; private originals are not listed); deploy_files is the same list in the form POST /sites and PUT /sites/{id} take (path, sha256, bytes, no content). With site_id and status done, site_version is the new version of the site that already has these files: send only the HTML. You may give a file another path in the deploy; keep its sha256 and bytes.

## Path parameters

- `id` string, uuid, required

## Response `200`

The drop link and its files.

- SiteDrop: A drop link and the files the user uploaded with it.
  - `id` string, uuid, required: The id of the drop link; pass it to get_drop (GET /sites/drops/{id}).
  - `status` 'open' | 'done' | 'expired', required: open: waiting for the user. done: the user uploaded the files. expired: 24 hours passed; create a new one.
  - `site_id` string, uuid, nullable, required: The site the link is for, or null.
  - `created_at` string, required
  - `expires_at` string, required: When the link stops working (24 hours after it was made).
  - `completed_at` string, nullable, required: When the user finished uploading, or null.
  - `images_only` boolean, required: True when the link only takes images (an editor made it).
  - `as_is` boolean: True when files are kept exactly as they are (for moving a site): no web versions, same names, and paths that follow the user's folders exactly.
  - `keep_zip` boolean: True when a .zip stays one file (a download) instead of being unpacked.
  - `strip` 'location' | 'all' | 'none', required: What the upload page removes from photos before upload: location (the default, only the GPS location), all (all metadata) or none. Web versions are re-encoded and carry no metadata at all.
  - `folder` string, nullable, required: The folder under /media/ the files land in, or null for the user's own folder names.
  - `max_files` integer, required: How many files the user can add with this link (a photo with its versions counts once).
  - `files` object[], required: The files that arrived, in order. Private originals are not listed.
    - `path` string, required: Where the file lives on the site, like /media/portfolio/project-12/03.webp. You can use another path in deploy_site; keep sha256 and bytes.
    - `sha256` string, required: The SHA-256 of the file.
    - `bytes` integer, required: The size in bytes.
    - `content_type` string, required: The type the file will be served with.
    - `name` string: The file name on the user's computer.
    - `variant` '2048' | '640': For photos made web-ready in the browser: 2048 is the web version (longest side at most 2048 px), 640 the small version of the same photo (path ends in -640). Use the small one in srcset, or for a thumbnail /_hypamoon/img?src=<path>&w=160 on the site.
    - `width` integer: Width in pixels, for photos.
    - `height` integer: Height in pixels, for photos.
  - `originals_kept` integer, required: How many originals were kept. They are private: never on a site, only downloadable in the portal.
  - `site_version` object, nullable, required: With site_id, after the user pressed Done: the new version of the site with these files (waiting: it waits for four-eyes approval). The files are already on the site; send only HTML with keep_existing.
    - `version_id` string, nullable, required
    - `version` integer, nullable, required
    - `waiting` boolean, required
    - `files` integer, required
  - `deploy_files` object[], required: The same files in the form deploy_site takes: add them to files, without content.
    - `path` string, required
    - `sha256` string, required
    - `bytes` integer, required
  - `url` string: Only when the link is created: the page to give the user. It is not shown again.
  - `user_message` string: A sentence to give the user.
  - `next_step` string: What to do next.

## Other responses

- `401`: Unauthorized: unauthorized, missing_api_key, invalid_api_key, api_key_revoked, project_deleted.
- `403`: Forbidden: project_not_enabled, key_mode_mismatch, missing_scope, verification_required.
- `404`: Not Found: not_found.
- `429`: Too Many Requests: rate_limited.
- `500`: Internal Server Error: internal_error.
- `503`: Service Unavailable: service_unavailable.

---

[API](https://skmtc.dev/hypamoon/apis/hypamoon-api.md) · [All operations](https://skmtc.dev/hypamoon/apis/hypamoon-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hypamoon/apis/hypamoon-api/revisions/9f0b90004c06?raw)