---
title: "Complete an MCP local-file upload"
method: PUT
path: "/media/upload"
tags: ["Media"]
---

# Complete an MCP local-file upload

`PUT /media/upload`

## Request

- Base URL: `https://api.postlake.dev`
- URL: `https://api.postlake.dev/media/upload`
- Auth: `bearerAuth` (a scheme the document does not define)

Upload raw file bytes to the short-lived target returned by the MCP upload_media tool when called without a URL. Send the returned upload token as `Authorization: Bearer …` and the exact returned Content-Type. This endpoint does not accept a PostLake API key and is not called until upload_media has prepared a media id and target.

## Response `201`

Uploaded; returns the MediaAsset whose id is ready for create_post

- MediaAsset
  - `deletionState` 'deleting': Cleanup is incomplete and can be retried. This upload cannot be used in new posts.
  - `retention` object: Minimum 90 days from upload on every plan while the account is open. Scheduled references remain protected until terminal state plus 30 days if later. No automatic expiry currently. Account deletion, verified erasure requests and legal/security removal are exceptions. Source URLs are public, not private storage.
    - `version` string
    - `minimumDays` integer
    - `minimumUntil` string, date-time
    - `scheduledProtection` string
    - `automaticExpiry` boolean
    - `exceptions` string[]
    - `scope` string
    - `accountRequirement` string
    - `publicUrls` boolean
    - `postRemovalDeletesMedia` boolean
    - `backupService` boolean
  - `id` string, required
  - `url` string, uri, required
  - `contentType` string, required
  - `size` integer, required
  - `createdAt` string, date-time, required
  - `width` integer: Pixel width. Images only, and absent when the header could not be read.
  - `height` integer: Pixel height. Images only, and absent when the header could not be read.

## Other responses

- `400`: Content type, byte signature, exact size, or media limits did not match the prepared target
- `401`: Upload token is missing, invalid, or expired
- `409`: The upload target has already been used

---

[API](https://skmtc.dev/postlake/apis/postlake-api.md) · [All operations](https://skmtc.dev/postlake/apis/postlake-api/llms.txt) · [OpenAPI document](https://skmtc.dev/postlake/apis/postlake-api/revisions/f81060e31f69?raw)