---
title: "Call the uploadAsset MCP tool"
method: POST
path: "/api/v1/actions/uploadAsset"
tags: ["Actions"]
---

# Call the uploadAsset MCP tool

`POST /api/v1/actions/uploadAsset`

## Request

- Base URL: `https://app.reachium.io`
- URL: `https://app.reachium.io/api/v1/actions/uploadAsset`
- Auth: HTTP bearer

Upload an image and get back a hosted https URL, without touching any post or document. The returned url works everywhere an image URL is accepted: updateDocument insert_image/replace_image (image_url), ![caption](url) lines in document markdown, and attachImageToPost (image_url). Use this when you have image bytes with no public URL (fresh creative, a local file the user shared): upload once, then reference the URL as many times as needed. Provide exactly one of image_url (fetched server-side, https only) or image_base64 (raw base64 bytes). 5 MB decoded cap either way; png/jpeg/webp/gif only, detected from the bytes themselves. EXIF/XMP metadata is stripped losslessly on ingest, and uploads count against a 500 MB workspace storage quota. Content-addressed: uploading the same bytes again returns the same URL, so retries are always safe. Returns url, name (usable as asset_name elsewhere), content_type, and bytes.

Called through the Actions bridge: the response is that tool's own result, wrapped as `{ data: <tool result> }` under HTTP 200. Billing, daily-cap, and confirm-step outcomes are embedded INSIDE `data`, never remapped to an HTTP status (see the templated `/api/v1/actions/{toolName}` operation above for the full protocol, and `x-mcp-actions` for this tool's machine-readable scope/cap/confirm_behavior fields). Authentication, request-shape, and optional idempotency-protocol failures still use their documented non-200 statuses.

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `image_url` string, uri: Public https URL to fetch and re-host. Pass this OR image_base64, never both.
  - `image_base64` string: Base64-encoded image bytes (5 MB decoded cap). Pass this OR image_url, never both.
  - `filename` string: Optional friendly name prefix for the stored asset, shown in listAssets (sanitized; extension is derived from the actual bytes).

## Response `200`

The result of calling this tool.

- object
  - `data` unknown, required
  - `error` unknown, required

## Other responses

- `400`: The request body was not a JSON object (code invalid_request), or Idempotency-Key is malformed (code invalid_idempotency_key).
- `401`: Missing or invalid API key. Send `Authorization: Bearer rmcp_...` (code unauthorized).
- `403`: This tool is out of the key’s granted scope (code insufficient_scope).
- `409`: This Idempotency-Key has an unresolved in-flight or ambiguous result (code request_in_flight). Reconcile before using a new key.
- `422`: This Idempotency-Key was already used with a different request body (code idempotency_key_reuse).
- `429`: Rate limited: shared `mcp:ip:{ip}` (600/60s) or `mcp:key:{keyId}` (120/60s) bucket, the SAME buckets the MCP endpoint uses (code rate_limited).
- `500`: Unhandled server error (code internal_error).

---

[API](https://skmtc.dev/reachium/apis/reachium-api.md) · [All operations](https://skmtc.dev/reachium/apis/reachium-api/llms.txt) · [OpenAPI document](https://skmtc.dev/reachium/apis/reachium-api/revisions/30c16b30b499?raw)