---
title: "Open a skill draft from an uploaded ZIP package"
method: POST
path: "/v1/skill-drafts/upload"
tags: ["skill-drafts"]
---

# Open a skill draft from an uploaded ZIP package

`POST /v1/skill-drafts/upload`

## Request

- Base URL: `https://api.patricia.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.patricia.app/v1/skill-drafts/upload`
- Auth: HTTP bearer

Upload a .zip containing a manifest.yaml (+ optional SKILL.md and reference/script files) and get an EDITABLE draft rather than a finished version. The archive is read safely in memory (no extraction, hard size/bomb/traversal caps) and every member it carries becomes a draft file you can change one at a time. Send the raw .zip as the request body.

## Query parameters

- `source_ref` string, nullable: The uploaded filename, for the record.

## Headers

- `X-Tenant-Id` string, nullable

## Response `201`

Successful Response

- SkillDraftDetail: One draft in full, returned to its author alone: the manifest plus the file list.
  - `id` string, uuid, required
  - `skill_id` string, uuid, nullable, required
  - `author_user_id` string, uuid, required
  - `title` string, required
  - `archetype_code` string, required
  - `source_kind` string, required
  - `published_at` string, date-time, nullable, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `file_count` integer
  - `slug` string, required
  - `validated_at` string, date-time, nullable, required
  - `validation_errors` string[]
  - `base_version_stale` boolean
  - `manifest` object
  - `base_version_id` string, uuid, nullable
  - `published_version_id` string, uuid, nullable
  - `files` DraftFileSummary[]
    - `path` string, required
    - `kind` string, required
    - `size_bytes` integer, required
    - `sha256` string, required
  - `source_ref` string, nullable

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden. Inspect response body `code` for the specific reason (for example: PERMISSION_DENIED, EMAIL_NOT_VERIFIED, TENANT_ACCESS_REQUIRED, ROLE_UNRESOLVED)
- `409`: Conflict
- `422`: Validation error

---

[API](https://skmtc.dev/patricia/apis/patricia-api.md) · [All operations](https://skmtc.dev/patricia/apis/patricia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/patricia/apis/patricia-api/revisions/0dfb44495ea1?raw)