NAnace
files

create_upload_grant

Mint a short-lived grant an end client redeems to upload directly. Cost class: fast.

The customer's backend holds the API key; the end user's browser must never see it. This mints an HMAC-signed token that authorizes exactly one thing — upload_file into this workspace, optionally pinned to one destination path and a byte cap — until expires_at. The holder sends it in the X-Upload-Token header of a multipart POST to upload_url, so the bytes travel end-client → NDI once instead of end-client → customer → NDI twice.

The grant is stateless (no DB row); its short TTL stands in for revocation, except that revoking the minting API key kills its outstanding grants immediately. Where the deployment runs Redis the grant is additionally single-use.

post/v1/workspaces/{workspace_id}/upload-grants

Request

Path parameters

workspace_idstring uuid required

Workspace identifier.

Request body

max_bytesinteger nullable

Per-grant byte cap, tighter than the service-wide cap for the pinned path. Omit to freeze the grant at that cap; an unpinned grant freezes at NDI_MAX_UPLOAD_BYTES.

pathstring nullable

Pin the upload to exactly this destination path. The platform-reserved '.workspace' subtree is not allowed. Omit to let the holder choose.

total_size_bytesinteger nullable

Exact expected upload size frozen into the grant. Distinct from max_bytes: a short body is rejected even when it fits under the cap.

ttl_secondsinteger

How long the grant verifies, in seconds.

Response

Successful Response

expires_atstring date-time required

When the grant stops verifying.

tokenstring required

Send in the X-Upload-Token header of the upload request.

upload_urlstring required

The upload_file route the token is valid against.

Changes

No recorded changes to this operation across all 2 revisions of this API.