---
title: "Retain exact authenticated company-icon bytes and return a digest-bound upload receipt for a Catalog submission."
method: POST
path: "/v1/submission-asset-uploads"
tags: ["Catalog"]
---

# Retain exact authenticated company-icon bytes and return a digest-bound upload receipt for a Catalog submission.

`POST /v1/submission-asset-uploads`

## Request

- Base URL: `https://api.sourcey.com`
- URL: `https://api.sourcey.com/v1/submission-asset-uploads`
- Auth: one of:
  - API key in cookie `sourcey_session`
  - HTTP bearer

## Headers

- `content-type` 'image/jpeg' | 'image/png' | 'image/webp' | 'image/svg+xml', required
- `x-sourcey-object-digest` string, required

## Response `201`

Successful response.

- UploadEntityAssetResponse201
  - `api_contract` 'sourcey.catalog-api/v1', required
  - `artifact_sha256` string, required
  - `data` object, required
    - `actor_id` string, required
    - `authentication_digest` string, required
    - `bytes` integer, required
    - `media_type` 'image/jpeg' | 'image/png' | 'image/webp' | 'image/svg+xml', required
    - `original_digest` string, required
    - `receipt_contract` 'sourcey.entity-asset-upload-receipt/v1alpha1', required
    - `retained_at` string, date-time, required
    - `storage_receipt_digest` string, required
    - `upload_receipt_digest` string, required
  - `release_id` string, required

## Other responses

- `400`: Invalid request.
- `401`: HTTP 401 response.
- `403`: HTTP 403 response.
- `405`: HTTP 405 response.
- `409`: HTTP 409 response.
- `429`: HTTP 429 response.
- `500`: HTTP 500 response.
- `503`: HTTP 503 response.

---

[API](https://skmtc.dev/sourcey/apis/sourcey-public-api.md) · [All operations](https://skmtc.dev/sourcey/apis/sourcey-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sourcey/apis/sourcey-public-api/revisions/437166b51fa5?raw)