Skip to main content
POST
Request a presigned upload URL.

Authorizations

Authorization
string
header
required

Pass a user JWT or a oag_ User API Key on the Authorization: Bearer <token> header. Both are validated by openapi-gateway against the Auth service.

Both credential types are user-scoped: every key (and every JWT) is bound to exactly one owner, and every route grants the caller full access to that owner's own resources. Cross-tenant access is denied by owner-ACL inside the handlers — there is no per-route scope vocabulary on this API.

Removed in v1.1.0: the legacy agents:* / tasks:* / files:* / instances:* scope set has been dropped together with the 403 insufficient_scope error. Existing oag_ keys automatically gain full owner-level access and do not need to be re-issued. SDK calls that previously passed scopes to createAPIKey should drop the argument. See the changelog at the bottom of this spec for the full migration note.

Body

application/json
filename
string
required

Original filename hint; stored on the file record.

Maximum string length: 512
content_type
string
required

MIME type of the bytes being uploaded (e.g. image/png). Uploads with a different Content-Type may be rejected by the storage backend.

Maximum string length: 255

Response

Presigned URL issued.

success
boolean
required
data
object