Skip to main content
GET
Get presigned upload URL

Authorizations

X-API-Key
string
header
required

Path Parameters

session_id
string
required

Unique session short_id identifier.

Query Parameters

photo_type
enum<string>
default:other

Photo classification used to namespace the generated S3 key. See PhotoTypeEnum for the full set.

Available options:
front,
back,
left,
right,
top,
bottom,
nutrition,
ingredients,
barcode,
recycling,
certification,
other
original_filename
string
default:photo.jpg

Original filename for extension detection.

Response

OK

Presigned upload URL and metadata.

The client sends the raw image bytes as the request body of a single PUT to upload_url, with exactly the headers in upload_headers. Those headers are part of the signature — changing or omitting one is a 403 from the bucket.

C-5227 replaced a presigned multipart POST (upload_fields) here: Cloudflare R2, which has held media since C-4517, does not implement the S3 POST Object API and answered every such upload with 501 NotImplemented.

upload_url
string
required

Presigned URL to PUT the image bytes to.

upload_method
string
required

HTTP method for the upload request. Always PUT.

Allowed value: "PUT"
upload_headers
Upload Headers · object
required

Headers that must be sent verbatim with the upload; they are signed.

s3_key
string
required

Object key where the file will be stored.

max_bytes
integer
required

Maximum accepted size. Enforced server-side when the upload is registered.

expires_in
integer
required

Seconds until the presigned URL expires.