---
title: "Finalize an upload session"
method: POST
path: "/vaults/v1/{vault_id}/upload-sessions/{upload_session_id}/finalize"
tags: ["vault"]
---

# Finalize an upload session

`POST /vaults/v1/{vault_id}/upload-sessions/{upload_session_id}/finalize`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/vaults/v1/{vault_id}/upload-sessions/{upload_session_id}/finalize`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer
  - HTTP bearer

Verifies STORAGE's authoritative checksum and length for every declared object (a COMPOSITE / multipart checksum is refused — uploads are single-part FULL_OBJECT only), writes the permanent lifecycle rows, charges the vault's accounted bytes, and returns the per-kind receipts a head carries. Client-asserted values are never billing inputs. Idempotent: replaying a finalized session returns the same receipts with `deduplicated: true`.

## Path parameters

- `vault_id` string, required
- `upload_session_id` string, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Response `200`

Idempotent replay of an already-finalized session

- object

## Other responses

- `201`: Finalized; server-verified receipts
- `400`: VALIDATION_FAILED — absent object, checksum/length mismatch, composite checksum, expired or aborted session
- `403`: VAULT_ACCESS_DENIED / QUOTA_EXCEEDED
- `429`: RATE_LIMITED — the per-principal or per-project finalized-object cap
- `503`: STORAGE_UNAVAILABLE

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)