---
title: "Spool Upload Endpoint"
method: POST
path: "/internal/spool-upload"
---

# Spool Upload Endpoint

`POST /internal/spool-upload`

## Request

- Base URL: `https://pozeidon.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://pozeidon.ai/internal/spool-upload`
- Auth: none declared

Service-to-service spool: sibling copilots (unity-copilot first) POST an
oversize tool result here as NDJSON text; we forward it to analyze-mcp's
/uploads (same short-TTL proxy JWT as backend/app/uploads.py's /api/uploads)
and hand back analyze's file sidecar (file_id, columns, sample, ...)
verbatim, so the caller can hand the agent a file_id instead of the raw
rows. HMAC-gated like the other /internal/* routes in this module — but
HMAC alone only proves "a sibling service", not "for THIS tenant": any
HMAC-authenticated caller could otherwise assert an arbitrary tenant_id, a
durable cross-tenant write. So the caller MUST also present, as a Bearer
token, the SAME pozeidon-signed JWT it was handed for its live MCP
request (minted by mint_tenant_jwt) — proof-of-tenant, verified against
our own signing keys (see auth.verify_tenant_proof_jwt) with its
`tenant_id` claim required to exactly match the body's tenant_id.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/pozeidon/apis/pozeidon-demo.md) · [All operations](https://skmtc.dev/pozeidon/apis/pozeidon-demo/llms.txt) · [OpenAPI document](https://skmtc.dev/pozeidon/apis/pozeidon-demo/revisions/de288dc26752?raw)