---
title: "Create an upload"
method: POST
path: "/projects/{projectId}/uploads"
tags: ["Uploads"]
---

# Create an upload

`POST /projects/{projectId}/uploads`

## Request

- Base URL: `https://api.rendley.com/v1`
- URL: `https://api.rendley.com/v1/projects/{projectId}/uploads`
- Auth: API key in header `Authorization`

Register a file and get a presigned URL to PUT its bytes to, then call the complete endpoint. media_id and file_hash are optional for API keys: the server generates the media_id (returned in the response) and records a placeholder hash. Use the media_id as the `media` reference of AI actions once the upload is complete.

## Path parameters

- `projectId` string, required

## Request body

- TypesUploadInput
  - `duration` number
  - `file_hash` string: FileHash is the client-computed content hash (XXH3-64, 16 hex chars). Optional for API keys.
  - `file_size` integer
  - `media_id` string: MediaId is the client-chosen media id (a UUID). Optional for API keys.
  - `metadata` string
  - `mime_type` string
  - `original_file_name` string
  - `project_id` string
  - `role` 'library' | 'pending' | 'staged' | 'transient': Role is the sync-lifecycle tag: "library" (reconciled by the editor's hash sync), "pending" (awaiting auto-injection into the library; invisible to the sync), "staged" (agent/AI workflow file; invisible to the sync AND not auto-injected — adopted to library only when explicitly referenced) or "transient" (never a library asset). Defaults to "library"; "pending" when Source is "mcp"; "staged" for API-key requests (so opening the project in the editor never reaps an API-uploaded file before it is referenced).
  - `source` 'editor' | 'mcp' | 'agent' | 'export' | 'ai' | 'duplicate': Source is provenance: which flow created the upload.

## Response `200`

OK

- object
  - `data` object: Success data
    - `media_id` string: MediaID identifies the file once complete: pass it as the `media` reference of AI actions and as an agent attachment. Echoes the request's media_id, or the server-generated one when the request sent none.
    - `presigned_url` string
    - `upload_id` string
  - `error` HttpResponseAPIError
    - `code` string
    - `fields` HttpResponseFieldError[]
      - `field` string
      - `message` string
    - `message` string
  - `meta` unknown

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden

---

[API](https://skmtc.dev/rendley/apis/rendley-api.md) - [All operations](https://skmtc.dev/rendley/apis/rendley-api/llms.txt) - [OpenAPI document](https://skmtc.dev/rendley/apis/rendley-api/revisions/7eb8713bbf78?raw)