Skip to main content

GetUploadURL generates a pre-signed URL for file upload.

POST 
/api/v1/uploads/files/widget/upload-url

DEPRECATED: use POST /api/v1/webchat/uploads (engagements service). The presigned-PUT flow exposed here only validates the client-declared content_type string, never the actual bytes, so a malicious browser can claim image/png and upload an executable. The new endpoint performs server-side MIME sniffing before persisting.

Returns a URL for direct upload to cloud storage. Widget performs PUT request to the URL with file data.

Parameters​

  • filename: Required, original filename
  • content_type: Required, MIME type of file
  • size_bytes: Required, file size in bytes
  • engagement_id: Optional, associate with engagement
  • message_id: Optional, associate with message

Response​

  • upload_url: Pre-signed PUT URL
  • method: HTTP method (typically "PUT")
  • headers: Required headers for upload request
  • file_id: ID to use when confirming upload
  • expires_at: URL expiration time

Errors​

  • INVALID_ARGUMENT: Invalid file type or size exceeds limit
  • UNAUTHENTICATED: Invalid or expired session token
  • RESOURCE_EXHAUSTED: Organization storage quota exceeded

Request​

Responses​

A successful response.