---
title: "Upload bytes against a signed ticket"
method: PUT
path: "/api/uploads/{token}"
tags: ["attachments"]
---

# Upload bytes against a signed ticket

`PUT /api/uploads/{token}`

## Request

- Base URL: `https://telawiki.com`
- URL: `https://telawiki.com/api/uploads/{token}`
- Auth: none required

Authorized by the HMAC ticket in the path, not by a session or token — so an agent can hand a file to tela without the bytes passing through its context. Single use, five-minute TTL.

The ticket is minted by the MCP tool `request_attachment_upload` and finalized by `confirm_attachment_upload`; **neither has a REST route**, so a pure-REST client should use `POST /api/pages/{id}/attachments` instead.

The request body is the raw file bytes with any content type.

## Response `200`

Stored.

- object
  - `attachment` AttachmentWithURLs, required
    - `id` integer, required
    - `name` string, required
    - `mime` string, required
    - `byte_size` integer, required
    - `hash` string, required: SHA-256 of the content, 64 lower-case hex characters.
    - `url` string, required: Relative path to the bytes: `/api/files/{space_id}/{hash}{ext}`.
    - `share_path` string, required: Relative path to the human-facing file page: `/f/{hash12}/{name}`.
    - `embedded` boolean, required: Whether the page body references this file.
    - `summary` string: Generated description, when one exists.
    - `download_url` string, required: Absolute URL to the bytes.
    - `share_url` string, required: Absolute URL to the file page.
    - `markdown` string, required: Ready-to-paste markdown that embeds or links the file.

## Other responses

- `400`: Malformed request. `code` is usually `bad_request` or `invalid_json`.
- `402`: `quota_exceeded` — a plan limit (pages, storage) was reached.
- `404`: `not_found` — invalid, expired, or unknown ticket.
- `409`: `already_uploaded` — this ticket was already used.
- `413`: `too_large` — the upload exceeds the instance's file size limit (50 MiB by default).
- `500`: `internal` — server error.

---

[API](https://skmtc.dev/telawiki/apis/tela-rest-api.md) · [All operations](https://skmtc.dev/telawiki/apis/tela-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/telawiki/apis/tela-rest-api/revisions/f316f31f6fcb?raw)