---
title: "Create an artifact upload session"
method: POST
path: "/api/v2/clients/management/artifacts"
tags: ["Clients", "Enterprise"]
---

# Create an artifact upload session

`POST /api/v2/clients/management/artifacts`

Endpoint for clients to create an artifact upload session and associate it
with a running management operation.

Note: caller must be a client. For users, this endpoint will return a 403 as
they are not expected or allowed to call this endpoint.

## Request body

- ModelClientArtifactUploadSessionCreateRequest
  - `operation_id` string, uuid, required
  - `artifact_type` 'support_bundle', required
  - `total_size` integer, required
  - `part_size` integer — Optional upload part size. When omitted or zero, the server default is used.
  - `part_count` integer, required
  - `content_type` string — Optional artifact content type. Support bundle uploads default to application/zip.
  - `checksum_algorithm` 'sha256' | 'sha512', required
  - `checksum` string, required — Hex-encoded checksum for the completed artifact.

## Response `200`

OK

- object
  - `data` ModelClientArtifactUploadSessionCreateResponse
    - `artifact_id` string, uuid
    - `client_id` string, uuid
    - `storage_key` string
    - `status` 'pending' | 'uploading' | 'complete' | 'failed' | 'canceled'
    - `part_size` integer
    - `part_count` integer
    - `missing_parts` integer[]
    - `management_operation` ModelClientManagementOperation
      - `id` string, uuid — This is the unique identifier for this object.
      - `client_id` string, uuid
      - `artifact_id` string, uuid, nullable
      - `type` 'support_bundle'
      - `status` 'queued' | 'running' | 'succeeded' | 'failed' | 'canceled'
      - `requested_by_user_id` string, uuid, nullable
      - `created_at` string, date-time
      - `updated_at` string, date-time
      - `started_at` string, date-time, nullable — An RFC-3339 formatted string
      - `completed_at` string, date-time, nullable — An RFC-3339 formatted string
      - `execution_time` string, date-time

## Other responses

- `400` — **Bad Request** This could be due to one of the following reasons: - JSON payload is missing or malformed - Path or query parameters are missing or invalid/malformed - The data sent is not valid (ex- sending a `string` in an `integer` field)
- `401` — **Unauthorized** This endpoint failed an authentication requirement. Either the client tried to access a protected endpoint without being authenticated, or an auth validation failed (ex- invalid credentials or expired token).
- `403` — **Forbidden** This is most commonly caused by an authenticated client trying to access a resource that it does not have permission for.
- `404` — **Not Found** This error typically comes from operations where a valid ID was passed to the request to look up an entity but the entity could not be found.
- `409` — Conflict
- `429` — **Too Many Requests** The client has sent too many requests within a certain time window and tripped the rate limiting middleware.
- `500` — **Internal Server Error** This is usually the result of either an unexpected database or application error. The client may try modifying or resending the request, but the error is likely not related to the client doing something wrong.

---

[API](https://skmtc.net/specterops/apis/bloodhound-api.md) · [All operations](https://skmtc.net/specterops/apis/bloodhound-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/specterops/bloodhound-api/revisions/b7bbf50b77e7/schema)