---
title: "Get a signed upload URL that needs no key"
method: POST
path: "/v1/uploads/tickets"
tags: ["Uploads"]
---

# Get a signed upload URL that needs no key

`POST /v1/uploads/tickets`

## Request

- Base URL: `https://api.tryplayhead.com`
- URL: `https://api.tryplayhead.com/v1/uploads/tickets`
- Auth: HTTP bearer

Returns a short-lived, signed URL that anybody holding the bytes can POST to without a credential of their own. This is how an agent running on a machine the API cannot reach sends a local file up: the ticket carries the authorization, so no key ever leaves your server.

`direct_url` is the address to ask for a link that writes into object storage instead. The ticket cannot carry one itself, because it is reusable for a whole folder and a storage link names one object.

## Response `200`

The ticket and where to send the bytes.

- UploadTicket
  - `ticket` string
  - `upload_url` string, uri
  - `direct_url` string, uri: Ask here for a link that writes into object storage. Absent on a server from before direct uploads existed.
  - `expires_at` string, date-time
  - `max_bytes` integer

## Other responses

- `401`: Missing, malformed or expired credential.

---

[API](https://skmtc.dev/tryplayhead/apis/playhead-api.md) · [All operations](https://skmtc.dev/tryplayhead/apis/playhead-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tryplayhead/apis/playhead-api/revisions/21dfb775b852?raw)