---
title: "Upload URL for a published-app visitor, authorized by app access (Cloud App Host only)"
method: POST
path: "/v1/cloud/apps/runtime/file-upload"
tags: ["v1", "Cloud Infrastructure"]
---

# Upload URL for a published-app visitor, authorized by app access (Cloud App Host only)

`POST /v1/cloud/apps/runtime/file-upload`

## Request

- Base URL: `https://memory.papr.ai`
- URL: `https://memory.papr.ai/v1/cloud/apps/runtime/file-upload`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer
- TypeScript: <https://skmtc.dev/papr-ai/apis/papr-memory-api/docs/v1/cloud/apps/runtime/file-upload/post.ts> (a function with typed inputs; its response is checked against the schema)

## Request body

- AppRuntimeFileUploadRequest: Browser upload from a published app, authorized by the app's sharing rules.
  - `external_user_id` string, nullable: Parse _User.objectId of the acting user (desktop OAuth). Used for ownership-scoped cloud operations instead of the API key user.
  - `namespaceId` string, required
  - `slug` string, required
  - `paprApiKey` string, nullable
  - `shareToken` string, nullable
  - `sha256` string, required
  - `sizeBytes` integer, required
  - `mime` string, nullable
  - `scope` 'app' | 'user'

## Response `200`

Successful Response

- AppRuntimeFileUploadResponse
  - `objectKey` string, required
  - `uploadUrl` string, nullable
  - `alreadyExists` boolean
  - `scope` string
  - `maxBytes` integer, required

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-31** `d56aec52fabd`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/papr-ai/apis/papr-memory-api/changes/v1/cloud/apps/runtime/file-upload/post.md)

---

[API](https://skmtc.dev/papr-ai/apis/papr-memory-api.md) - [All operations](https://skmtc.dev/papr-ai/apis/papr-memory-api/llms.txt) - [OpenAPI document](https://skmtc.dev/papr-ai/apis/papr-memory-api/revisions/957add0fe202?raw)