Write upload bytes (proxy sink)
Public endpoint receiving upload bytes on the app domain — used by filesystem storage, and by S3 storage in proxy mode (S3_PUBLIC_ENDPOINT unset; the platform streams the body to the private bucket server-side). Authenticated via HMAC-signed token query parameter returned in the upload descriptor. The token binds storage key, declared MIME, declared size and expiry; the size is enforced while the body streams to the backend (chunked uploads cannot exceed it) and re-checked exactly on completion — a body shorter than the declared size is rejected and rolled back so the token stays usable for a retry. The expiry is also enforced during streaming, not just when the PUT starts. In direct-presign S3 mode (S3_PUBLIC_ENDPOINT set) the signed URL points directly at the bucket and this endpoint is not used. Rate-limited per IP (60/min).
/api/uploads/_contentQuery Parameters
HMAC-signed upload token (opaque base64url.base64url).
Request Body
application/octet-stream
binarycurl -X PUT "https://your-instance/api/uploads/_content?token=string" \ -H "Content-Type: application/octet-stream" \ -d 'string'{
"type": "https://docs.appstrate.dev/errors/validation-failed",
"title": "Validation Failed",
"status": 400,
"detail": "name: Invalid input: expected string, received undefined (+2 more)",
"code": "validation_failed",
"request_id": "req_abc123",
"errors": [
{
"field": "name",
"code": "required",
"message": "Invalid input: expected string, received undefined"
},
{
"field": "email",
"code": "invalid_format",
"message": "Invalid email address"
},
{
"field": "age",
"code": "invalid_type",
"message": "Invalid input: expected number, received string"
}
]
}{
"type": "https://docs.appstrate.dev/errors/unauthorized",
"title": "Unauthorized",
"status": 401,
"detail": "Invalid or missing session",
"code": "unauthorized",
"request_id": "req_abc123"
}{
"type": "http://example.com",
"title": "string",
"status": 0,
"detail": "string",
"instance": "string",
"code": "string",
"request_id": "string",
"param": "string",
"retry_after": 0,
"errors": [
{
"field": "string",
"code": "string",
"message": "string",
"title": "string",
"candidate_connections": [
{
"id": "string",
"label": "string",
"account_id": "string",
"owned_by_actor": true,
"needs_reconnection": true
}
],
"connection_id": "string",
"missing_scopes": [
"string"
],
"owned_by_actor": true,
"required_scopes": [
"string"
],
"auth_key": "string",
"required_auth_key": "string",
"available_auth_keys": [
"string"
],
"connect_url": "http://example.com",
"expiresAt": "2019-08-24T14:15:22Z",
"packageId": "string"
}
]
}{
"type": "https://docs.appstrate.dev/errors/rate-limited",
"title": "Rate Limited",
"status": 429,
"detail": "Too many requests. Please try again shortly.",
"code": "rate_limited",
"request_id": "req_abc123",
"retry_after": 30
}