---
title: "Upload a file (server-proxied)"
method: POST
path: "/api/workspaces/{slug}/files/proxy-upload"
tags: ["Files"]
---

# Upload a file (server-proxied)

`POST /api/workspaces/{slug}/files/proxy-upload`

## Request

- Base URL: `https://trydock.ai`
- URL: `https://trydock.ai/api/workspaces/{slug}/files/proxy-upload`
- Auth: HTTP bearer

Multipart upload that streams bytes through the server. Used for SVG (server-side DOMPurify sanitization) and raster images (EXIF strip + 256-px webp thumb generation). Capped at 25 MB by the serverless body limit. Larger files MUST use the direct-to-blob token route (`POST /api/workspaces/{slug}/files`).

## Path parameters

- `slug` string, required

## Request body `multipart/form-data`

- object
  - `surface_slug` string, required
  - `parent_folder_id` string
  - `file` string, binary

## Response `200`

File row

- object
  - `id` string, required
  - `name` string, required
  - `parentFolderId` string, nullable, required
  - `size` integer, required: Bytes.
  - `mimeType` string, required
  - `thumbUrl` string, nullable, required: Server-generated 256-px webp URL. Null for non-raster files.
  - `starred` boolean
  - `starredAt` string, date-time, nullable
  - `description` string, nullable
  - `tags` string[]
  - `exif` object, nullable
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required

## Other responses

- `400`: Bad MIME / sanitization rejected
- `413`: Over per-file or per-tier storage cap

## Changes

- **2026-11-05** `767beae124a8`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/trydock/apis/dock-rest-api/changes/api/workspaces/:slug/files/proxy-upload/post.md)

---

[API](https://skmtc.dev/trydock/apis/dock-rest-api.md) - [All operations](https://skmtc.dev/trydock/apis/dock-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/trydock/apis/dock-rest-api/revisions/dd96ae96a412?raw)