---
title: "Create a device upload link"
method: POST
path: "/v0/media/upload-link"
tags: ["Media"]
---

# Create a device upload link

`POST /v0/media/upload-link`

## Request

- Base URL: `https://api.schedulin.app`
- URL: `https://api.schedulin.app/v0/media/upload-link`
- Auth: one of:
  - API key in header `x-api-key`
  - OAuth 2 (authorization code, authorization URL `https://api.schedulin.app/oauth/authorize`, token URL `https://api.schedulin.app/oauth/token`, scopes: `media:write`)

Returns a short-lived URL to a page where the user uploads files from their device (or a pasted attachment) straight into the media library. Hand the URL to the user; once they've uploaded, call GET /v0/media (list media, newest first) and reference the returned `url` when creating a post. Use this whenever the file isn't already at a public URL.

## Request body

- object
  - `expiresInHours` integer

## Response `200`

OK

- object
  - `url` string, required
  - `expiresAt` string, date-time, required

## Other responses

- `400`: Bad Request — the request isn't allowed in the resource's current state (e.g. editing a published post).
- `401`: Unauthorized — missing or invalid API key / access token.
- `403`: Forbidden — the credential lacks the required scope or access.
- `409`: Conflict
- `422`: Unprocessable request. Schema validation failures have `code: "INPUT_VALIDATION_FAILED"` and `data.fieldErrors` mapping each invalid field to its messages (nested issues name their full path, e.g. `media[0].url: ...`). Business-rule rejections (e.g. a `scheduledAt` in the past) have `code: "UNPROCESSABLE_CONTENT"` and carry the reason in `data.message` and `data.formErrors`.
- `429`: Rate limit exceeded. Wait `Retry-After` seconds before retrying.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/schedulin/apis/schedulin-api.md) · [All operations](https://skmtc.dev/schedulin/apis/schedulin-api/llms.txt) · [OpenAPI document](https://skmtc.dev/schedulin/apis/schedulin-api/revisions/17e886f3bcf3?raw)