---
title: "Upload bytes to an upload session"
method: PUT
path: "/files/upload/{session_id}"
tags: ["Files"]
---

# Upload bytes to an upload session

`PUT /files/upload/{session_id}`

## Request

- Base URL: `https://api.varg.ai/v2`
- URL: `https://api.varg.ai/v2/files/upload/{session_id}`
- Auth: none required

Second step of the large-file flow started by `POST /files/upload-session`.
Send the raw file bytes as the request body (not multipart) with the
`Content-Type` from the session. Maximum size is 200 MB. A session
accepts one upload and expires after 1 hour.

This endpoint needs no API key: the unguessable `session_id` is the
credential, and CORS allows any origin so browser widgets can call it.
The file is registered in your account automatically; `registered` is
`false` only if registration failed after the bytes were stored, in
which case call `POST /files/import` with `public_url`.

## Path parameters

- `session_id` string, required

## Response `200`

Bytes stored

- UploadSessionResult
  - `ok` boolean, required
  - `public_url` string, required
  - `size` integer, required: Bytes stored
  - `media_type` string, required
  - `file_id` string, nullable: Null when registration failed (`registered` is false)
  - `registered` boolean, required: Whether the file was added to your Files

## Other responses

- `400`: Empty body (`empty_body`) or missing session id (`missing_session`)
- `410`: Session not found, expired, or already used (`session_expired`). Create a new session.
- `413`: File larger than 200 MB (`file_too_large`)
- `500`: Storing the file failed (`upload_failed`)

## Changes

- **2026-10-20** `43bcf5ea398d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/varg/apis/varg-api/changes/files/upload/:session_id/put.md)

---

[API](https://skmtc.dev/varg/apis/varg-api.md) · [All operations](https://skmtc.dev/varg/apis/varg-api/llms.txt) · [OpenAPI document](https://skmtc.dev/varg/apis/varg-api/revisions/09d49a6d852f?raw)