media
browser-session

Upload a media file to the site blob store

Clerk ADMIN session only (NOT reachable with an agt_ bearer). Takes the bytes base64-encoded in a JSON body rather than multipart, preserving the wire format the existing site clients already send. mediaType is derived server-side from the content type plus the filename extension and echoed back so a caller can drop the result into the right block field. Script-capable types (SVG/XML/HTML) are refused outright with a 415 — an uploaded SVG is a stored-XSS vector against the very operator session that uploaded it.

post/api/upload-media

Request

  • Base URL: https://www.immersivecommons.com
  • URL: https://www.immersivecommons.com/api/upload-media
  • Auth: API key in cookie __session

Request body

datastring required

The file bytes, base64-encoded. 10MB decoded ceiling.

filenamestring

Used for the 3D-format extension hints and for the stored path; non-alphanumerics are replaced with underscores.

contentTypestring required

image/, video/, model/*, or a .glb/.gltf/.splat/.ply filename. SVG/XML/HTML are refused.

Response

The hosted file.

urlstring required

Public blob URL of the stored file.

contentTypestring required

Echoed back unchanged.

mediaType'image' | 'video' | 'model3d' | 'gaussianSplat' required

Derived server-side from the content type + extension, so the caller does not have to classify it.

Changes

No recorded changes to this operation across all 1 revision of this API.