---
title: "Authorize a direct private Blob upload"
method: POST
path: "/uploads/intent"
tags: ["Batches and files"]
---

# Authorize a direct private Blob upload

`POST /uploads/intent`

## Request

- Base URL: `https://www.sanctionskit.com/api/v1`
- URL: `https://www.sanctionskit.com/api/v1/uploads/intent`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/sanctionskit/apis/sanctionskit-api/docs/uploads/intent/post.ts> (a function with typed inputs; its response is checked against the schema)

Required API key scope: batches:write.

## Request body

- UploadIntentRequest
  - `sizeBytes` integer: Exact UTF-8 byte size of the NDJSON upload. Maximum 26,214,400 bytes (25 MiB). Omission reserves the full maximum for legacy clients. The entire body may also be omitted.

## Response `201`

Successful response. JSON object with the required data key. All properties marked required are present, including keys whose value may be null. Unmarked properties can be omitted; clients should tolerate additional response properties.

- object
  - `data` UploadIntent, required
    - `id` string, uuid, required
    - `pathname` string, required
    - `access` 'private', required
    - `handleUploadUrl` '/api/v1/uploads', required
    - `maxBytes` integer, required
    - `reservedBytes` integer, required
    - `format` string, required

## Other responses

- `400`: **invalid_request** — Correct the request fields, resource identifiers, JSON body or query parameters before retrying.
- `401`: **authentication_required** — Send Authorization: Bearer with a valid API key. An omitted header can produce authentication_required; invalid supplied credentials produce invalid_api_key. **invalid_api_key** — Use an active key for the intended environment.
- `402`: **subscription_required** — Use the synthetic sandbox or arrange an active production subscription before retrying.
- `403`: **permission_denied** — Ask an organization owner to grant the required role or API-key scope. **insufficient_scope** — Use a key with the scope stated in this operation.
- `405`: **method_not_allowed** — Use a method in the Allow response header. OPTIONS lists supported methods; HEAD follows GET authorization and returns no body.
- `408`: **invalid_request** — Reconnect and retry using the same idempotency key and identical input where supported.
- `413`: **response_too_large** — Reduce the requested page size or use the documented segmented case archive. No evidence is silently truncated. **invalid_request** — Reduce the JSON request size to the documented limit.
- `415`: **invalid_request** — Use Content-Type: application/json and an uncompressed UTF-8 body.
- `429`: **rate_limited** — Wait for the request window to reset and retry with backoff. **upload_quota_exceeded** — Wait for expired uploads to be deleted before requesting another upload intent.
- `500`: **internal_error** — Retry with backoff. For writes reuse the same idempotency key and identical input; include requestId when contacting support.
- `503`: **temporarily_unavailable** — Honor Retry-After when present and retry with bounded backoff. Follow this endpoint’s retry contract; preserve the same key and input for idempotent writes. Contact support with requestId if the failure persists.

---

[API](https://skmtc.dev/sanctionskit/apis/sanctionskit-api.md) - [All operations](https://skmtc.dev/sanctionskit/apis/sanctionskit-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sanctionskit/apis/sanctionskit-api/revisions/ee35d211051a?raw)