---
title: "Upload a file or zip to an application as a commit"
method: POST
path: "/v2/apps/{appId}/commit"
tags: ["Deployments", "Lifecycle"]
---

# Upload a file or zip to an application as a commit

`POST /v2/apps/{appId}/commit`

Streams a `multipart/form-data` file to the application. A `.zip` is unpacked at the destination; other files are placed at `path/name`. The optional `path` query parameter controls the destination directory inside the application.

File names that look like path traversal, control characters, or `.`/`..` are rejected. Content-Type is derived server-side from the extension.

Requires the workspace Maintainer or Administrator role (or ownership) when called against a workspace-shared application. Rate limits: 1 commit per 2s per user (global) and 1 commit per 5s per (user, application).

## Path parameters

- `appId` string, required

## Query parameters

- `path` string

## Response `200`

Commit accepted and applied.

- object
  - `status` 'success', required

## Other responses

- `400` — The upload was rejected by validation or storage.
- `401` — The Authorization header is missing, malformed, or the credentials are not valid.
- `403` — The workspace member does not have the required permission for this endpoint.
- `404` — The target application could not be found, or the caller is not a member of the workspace.
- `413` — Upload exceeded the 100 MB per-file limit.
- `415` — Request is not `multipart/form-data`.
- `429` — The endpoint enforces its own rate limit and the caller hit the cooldown.
- `500` — An unexpected error occurred while processing the request.

---

[API](https://skmtc.dev/squarecloud/apis/square-cloud-api.md) · [All operations](https://skmtc.dev/squarecloud/apis/square-cloud-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/squarecloud/square-cloud-api/revisions/54b7733a6b95/schema)