---
title: "Prepare a one-time attachment upload"
method: POST
path: "/mailboxes/{id}/staged-attachment-upload-tokens"
tags: ["Mailboxes", "Messages"]
---

# Prepare a one-time attachment upload

`POST /mailboxes/{id}/staged-attachment-upload-tokens`

## Request

- Base URL: `https://shipmail.to/api/v1`
- URL: `https://shipmail.to/api/v1/mailboxes/{id}/staged-attachment-upload-tokens`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://shipmail.to/api/auth/oauth2/authorize`, token URL `https://shipmail.to/api/auth/oauth2/token`)

Create a five-minute, single-use upload URL bound to this API key, organization, mailbox, filename, content type, byte size, and SHA-256 digest. Idempotency-Key is forbidden because the response contains a one-time URL.

## Headers

- `X-Shipmail-Organization` string

## Request body

- PrepareStagedAttachmentUploadRequest
  - `filename` string, required
  - `content_type` string, required
  - `size` integer, required
  - `sha256` string, required

## Response `201`

One-time upload prepared.

- StagedAttachmentUpload
  - `object` 'staged_attachment_upload', required
  - `mailbox_id` string, required
  - `filename` string, required
  - `content_type` string, required
  - `size` integer, required
  - `sha256` string, required
  - `upload_url` string, uri, required
  - `expires_at` string, date-time, required

## Other responses

- `403`: Insufficient permissions.
- `404`: Resource not found.
- `422`: Validation failed.
- `429`: Rate limit exceeded.

---

[API](https://skmtc.dev/shipmail/apis/shipmail-api.md) · [All operations](https://skmtc.dev/shipmail/apis/shipmail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/shipmail/apis/shipmail-api/revisions/2c23e59d7e30?raw)