Skip to main content
Files

Upload a File

Forward API reference.

Description

Uploads file content and creates a File.

Path

POST /api/v1/forward/files

Request headers

HeaderRequiredDescription
AuthorizationYesBearer <PAT or SAT>
Idempotency-KeyNoOptional idempotency key for create requests. The same key can only be reused for the same request. If omitted, local idempotent replay protection is not provided.
Content-TypeYesmultipart/form-data

Form fields

FieldTypeRequiredDescription
filefileYesFile content to upload. See Supported upload file types.
namestringNoDisplay filename. Defaults to the multipart filename; after normalization it must be 1-255 bytes.
metadataJSON stringNoMetadata object. created_by is reserved and must not be supplied (supplying it returns 400).

Example request

curl -X POST "https://api.qoder.com/api/v1/forward/files" \
  -H "Authorization: Bearer $QODER_ACCESS_TOKEN" \
  -H "Idempotency-Key: create-file-001" \
  -F "file=@report.pdf;type=application/pdf" \
  -F "name=report.pdf" \
  -F 'metadata={"source":"console"}'

Example response

HTTP 201 Created
{
  "id": "file_xxx",
  "type": "file",
  "filename": "report.pdf",
  "size_bytes": 1024,
  "mime_type": "application/pdf",
  "created_at": "2026-07-23T10:00:00Z",
  "updated_at": "2026-07-23T10:00:00Z",
  "downloadable": false,
  "scope": null,
  "metadata": {
    "source": "console"
  },
  "identity_id": null
}

Response fields

FieldTypeDescription
idstringFile ID.
typestringAlways file.
filenamestringFilename.
size_bytesintegerFile size in bytes.
mime_typestringMIME type.
created_atstringCreation time in RFC 3339 format.
updated_atstringLast update time in RFC 3339 format.
downloadablebooleanWhether the File can be downloaded.
scopeobject/nullResource scope associated with the File, such as a Session.
metadataobjectFile metadata.
identity_idstring/nullForward identity owner.

Errors

HTTPTypeTrigger
400invalid_request_errorThe request body, path parameters, query parameters, or multipart fields are invalid.
400invalid_request_errorThe file type is unsupported. See Supported upload file types.
400invalid_request_errorIf the reserved key created_by is supplied, message is metadata key "created_by" is reserved, identifying the invalid field.
401authentication_errorThe authentication token is missing or invalid.
403permission_errorThe caller cannot access this resource.
409conflict_errorThe resource state, references, or idempotency key conflict.
429rate_limit_errorUpload capacity is insufficient.
500/502/503api_errorForward or a dependent service failed.