---
title: "Upload a file from a published app (public, append-only)"
method: POST
path: "/public/uploads/{token}"
tags: ["app-data"]
---

# Upload a file from a published app (public, append-only)

`POST /public/uploads/{token}`

## Request

- Base URL: `https://api.onplana.com/api`
- URL: `https://api.onplana.com/api/public/uploads/{token}`
- Auth: none required

Accepts one multipart file in the field `file`, plus an empty hidden `_honeypot` field. The file lands as a document in a library the app owner controls; the app can NEVER read it back, so do not build a gallery of uploads. The response carries a `fileRef` to echo as `_files` on a subsequent form submission to link the two. ALWAYS returns 200: on any drop the fileRef is a decoy, so it cannot be used to detect whether the upload was stored.

## Path parameters

- `token` string, required

## Response `200`

Always 200. `{ ok: true, fileRef }` , fileRef is a decoy when the upload was dropped.

---

[API](https://skmtc.dev/onplana/apis/onplana-api.md) · [All operations](https://skmtc.dev/onplana/apis/onplana-api/llms.txt) · [OpenAPI document](https://skmtc.dev/onplana/apis/onplana-api/revisions/c3d6c89e9dc8?raw)