---
title: "Get an upload slot"
method: POST
path: "/media/ticket"
---

# Get an upload slot

`POST /media/ticket`

## Request

- Base URL: `https://xpost.to/api/v1`
- URL: `https://xpost.to/api/v1/media/ticket`
- Auth: HTTP bearer

Mint an upload slot for a script or sandbox that holds a file and cannot POST it to /media directly. Not part of the MCP surface since 2026-09-15: an assistant's attachment goes through `create_post.files` or `media_pending` and the approval card. Always returns `{ticket, attach_url, max_bytes, expires_in_seconds}`: `attach_url` takes the file straight from a BROWSER (`POST` multipart with a `file` field) and answers with the `media_id` directly. When a doorstep bucket is configured the reply ALSO carries `{url, fields, curl}`, a presigned path-style S3 POST: post the file there (the `file` field must come LAST), then redeem `ticket` at `POST /media`, and we collect the object, sniff its real type from the bytes and delete it. Nothing of yours is stored on S3. A slot lasts half an hour, covers several files, and a failed step does not use it up — fix the step and redeem the same ticket.

## Response `200`

Slot minted

- object
  - `ticket` string
  - `url` string, uri
  - `fields` object
  - `curl` string
  - `max_bytes` integer
  - `expires_in_seconds` integer

## Other responses

- `401`: Missing or invalid API key
- `403`: Missing posts:write scope
- `429`: Rate limited
- `503`: Ticket uploads are not configured on this instance

---

[API](https://skmtc.dev/xpost/apis/xpost-api.md) · [All operations](https://skmtc.dev/xpost/apis/xpost-api/llms.txt) · [OpenAPI document](https://skmtc.dev/xpost/apis/xpost-api/revisions/9f570fcfed6d?raw)