---
title: "Create Attachment Upload Url"
method: POST
path: "/v1/files/upload-url"
tags: ["v1", "protected", "files"]
---

# Create Attachment Upload Url

`POST /v1/files/upload-url`

Mint a presigned PUT for a task attachment uploaded directly to the store.

The client-declared sha256 is bound into the signature as ``ChecksumSHA256``,
so the object store rejects a body that does not hash to it — the upload is
content-verified without the API ever seeing the bytes. The returned ``ref``
is consumed by the task-create endpoint exactly like a server-proxied one.

## Request body

- PresignUploadRequest
  - `content_type` string, required
  - `filename` string, required
  - `sha256` string, required
  - `size` integer, required

## Response `200`

Successful Response

- PresignUploadResponse
  - `expires_in` integer, required
  - `ref` string, required
  - `upload_url` string, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/agentarea/apis/agentarea-api.md) · [All operations](https://skmtc.net/agentarea/apis/agentarea-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/agentarea/agentarea-api/versions/e3650e48373b/schema)