---
title: "Import a file by URL"
method: POST
path: "/files/import"
tags: ["Files"]
---

# Import a file by URL

`POST /files/import`

## Request

- Base URL: `https://api.varg.ai/v2`
- URL: `https://api.varg.ai/v2/files/import`
- Auth: HTTP bearer

Register a file from a URL. varg-hosted URLs (`s3.varg.ai`, `uu.varg.ai`, ...) are
registered without re-uploading; external URLs are streamed to varg
storage. SSRF-protected (private IPs and localhost are rejected).

## Headers

- `X-Workspace-Id` string

## Request body

- object
  - `url` string, uri, required
  - `filename` string
  - `media_type` string
  - `origin` 'upload' | 'generated': Explicit provenance (defaults to `generated` for varg URLs, `upload` for external)
  - `hash` string: sha256 of the bytes for dedup (`sha256:<hex>` or bare hex)
  - `size` integer
  - `workspace_id` string: File the import into this folder (id or slug). The `X-Workspace-Id` header also works.
  - `metadata` object: Client-measured metadata (width, height, duration_ms, ...). Max 20 keys; non-scalar values and strings over 200 characters are dropped.

## Response `200`

File imported (or deduplicated). `size` can be 0 for varg-hosted URLs registered without bytes.

- FileUploadResponse
  - `file_id` string, required
  - `url` string, required: Stable varg-hosted URL
  - `hash` string, nullable
  - `size` integer, required
  - `media_type` string, required
  - `filename` string, nullable
  - `title` string, nullable
  - `subtitle` string, nullable
  - `metadata` object, nullable
  - `deduplicated` boolean, required: true when an existing file with the same content was returned
  - `origin` 'upload' | 'generated': Present on `/files/import` responses

## Other responses

- `400`: Invalid JSON (`invalid_json`), missing URL (`missing_url`), unsafe URL (`unsafe_url`), invalid origin (`invalid_origin`), or a varg URL whose object does not exist (`upload_not_found`)
- `401`: Missing or invalid API key / JWT
- `404`: Unknown folder (`workspace_not_found`)
- `502`: Fetch or store failed (`import_failed`)

## Changes

- **2026-10-20** `43bcf5ea398d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/varg/apis/varg-api/changes/files/import/post.md)

---

[API](https://skmtc.dev/varg/apis/varg-api.md) · [All operations](https://skmtc.dev/varg/apis/varg-api/llms.txt) · [OpenAPI document](https://skmtc.dev/varg/apis/varg-api/revisions/09d49a6d852f?raw)